Cut Your AWS Lambda Logging Costs: Filter Logs with AWS SAM

Introduction

AWS Lambda is a serverless compute service that scales automatically based on demand. However, the pay-per-use model extends to your logs as well—excessive logging can significantly increase your Amazon CloudWatch Logs costs. In this article, we’ll look at how to configure and filter Lambda logs using AWS SAM (Serverless Application Model) so you capture only the logs you truly need, especially during periods of high load.

---

Default Logging in AWS Lambda

By default, Lambda writes plain text logs to CloudWatch. While this is convenient, it can make filtering specific log levels (e.g., DEBUG, INFO, WARN, ERROR) difficult, potentially creating large volumes of unnecessary logs.

Sample Node.js Lambda

exports.handler = async (event) => {
  console.debug("DEBUG: This is a debug message.");
  console.log("INFO: This is an informational message.");
  console.warn("WARN: This is a warning message.");
  console.error("ERROR: This is an error message.");

  return {
    statusCode: 200,
    body: JSON.stringify({ message: "Hello from Lambda!" }),
  };
};

AWS SAM function configuration

Globals:
  Function:
    Runtime: !Ref NodeRuntime
    Handler: index.handler
    Tags:
      App: !Ref App
      Project: !Ref Project

Resources:

  # Functions
  FilteringLogsFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: filtering-logs
      FunctionName: !Sub ${App}-filtering-logs
      Description: Filter logs by log level

In CloudWatch, you might see something like:

All entries appear as plain text, making it difficult to filter precisely—and potentially driving up your log storage costs.

---

Configuring Logs with AWS SAM

To better control which logs get stored, you can specify LoggingConfig in your SAM template as described here. Pay attention this configuration is not supported in the Global section of SAM template.
This configuration helps you define log levels, format, and the target log group in a more structured way, so you don’t end up paying for excessive logs especially during high load.

SAM Template

  FilteringLogsFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: filtering-logs
      FunctionName: !Sub ${App}-filtering-logs
      Description: Filter logs by log level
      LoggingConfig:
        ApplicationLogLevel: INFO
        LogFormat: JSON

What These Settings Do

• ApplicationLogLevel: Filters application-level logs (e.g., DEBUG, INFO, WARN, ERROR). Anything below this level won’t be logged.
• LogFormat: Possible values are Text (default) or JSON. When using Text, filtering by log level is not supported, which can lead to higher logging costs. Switching to JSON enables log-level filtering and makes logs more structured.

In CloudWatch, you might see something like:

By switching from the default Text format to JSON and setting appropriate log levels, you can drastically reduce log volume and costs during high load. Structured logs are also much easier to parse and filter in CloudWatch Logs Insights or other monitoring tools.

---

Additional Tools for Advanced Logging

While SAM’s built-in LoggingConfig is powerful, you may want even more control over your logging. Libraries such as AWS Lambda Powertools (available for multiple runtimes e.g. python) provide additional features like structured logging, tracing, and correlation IDs. These can help you further refine and filter your logs, improve observability, and reduce costs by focusing on the most important information.

---

Conclusion

Logging is essential for monitoring and troubleshooting AWS Lambda functions, but excessive logs can quickly inflate costs. By leveraging AWS SAM and its LoggingConfig parameters—especially switching to JSON and setting appropriate log levels—you can store only the logs that matter most. In addition, libraries like AWS Lambda Powertools can offer even more granular control. This approach not only cuts costs but also streamlines your troubleshooting and monitoring process.