How to pull specific information (like instance ID) out of a alarm (using costum metric) in Lambda

Question

I have ec2 instance on AWS cloud and I am using Cloudwatch agent to send log messages to a Log group. Based on a specific error message used as pattern I am filtering the log messages coming from the ec2 instance and if the messages match the pattern for 3 times I have an Alarm! What I need now is to run Lambda function once I have the alarm. This Lambda must get the ID of the instance on which we have the alarm (error message).

1. how I can run Lambda function based on alarm (for exemple : I can run Lambda function based on sending email via specific SNS topic) I want do the same via alarms.
2. I want get the ID of the instance (on witch I have the error message) as input parameter for my Lambda function, that lambda function must be executed once I have an alarm with the ID as input. Thanks for your help !

Answer 1

For the general question you can pass the instance ID as a metric dimension:

For example, many Amazon EC2 metrics publish InstanceId as a dimension name, and the actual instance ID as the value for that dimension.

For the specific points:

1. You can make the CloudWatch alarm send a message to an SNS topic. Then you can subscribe a Lambda function to the topic and receive the alarm messsage.
2. You can publish the Instance ID as a dimension in the logs metric filter.

Additional references:

• Example: Extract fields from an Apache log and assign dimensions
• Why isn't Amazon SNS invoking my Lambda function when triggered by a CloudWatch alarm?