Cloludwatch logging message format changed

[h2ppy]

After migration from 64bit Amazon Linux 2018.03 v2.11.8 running Java 8 to 64bit Amazon Linux 2 v3.2.4 running Corretto 11 the log file for the elastic beanstalk has been changed from /aws/elasticbeanstalk/{env}/var/log/web-1.log to /aws/elasticbeanstalk/{env}/var/log/web.stdout.log and the change of message format in cloudwatch. Earlier the message logged was the {"key":"string"} now it is being prepended by a time stamp and the ip of the instance for example Jul 31 15:17:13 ip-10-10-20-192 web:{"key":"string"}. How can we get back the original message logged by the application.

[alextanhongpin]

We are facing the same issue when migrating from from Go 1 running on 64bit Amazon Linux/2.15.1 to Go 1 running on 64bit Amazon Linux 2/3.4.6.

In the old AL, logs are split into web-1.log and web-1.error.log which we streamed to Cloudwatch. In AL2 however, they seem to streamed only to web.stdout.log with the additional prefix web: your log as mentioned by the issue above. Aside from that, the logs are somehow mixed with the nginx access logs when we are expecting only application logs.

We managed to fix it by referring to the solution by puttputt on StackOverflow, together with the configuration files setting here.

Note that when streaming the logs, you have to specify the aws region too (which differs from the AL config) that we had:

files:
  "/etc/awslogs/awscli.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [plugins]
      cwlogs = cwlogs
      [default]
      region = `{"Ref":"AWS::Region"}`

Otherwise, your logs will be streamed to us-east-1 by default, which is something we don't expect ...