如何使用AWS SDK for .NET向单个CloudWatch日志流发送多条日志？

前提准备 #

• 通过NuGet安装AWSSDK.CloudWatchLogs包
• 确保应用程序拥有CloudWatch Logs的logs:PutLogEvents权限，可通过IAM策略配置

核心要点 #

调用PutLogEvents API时需注意：

• 每条日志事件必须包含UTC时间戳（精确到毫秒）和日志内容
• 需指定目标日志组与日志流名称
• 首次向新日志流发日志时，序列令牌（SequenceToken）可设为null；后续发送必须用上一次调用返回的NextSequenceToken，否则会触发报错

C#代码示例 #

using Amazon;
using Amazon.CloudWatchLogs;
using Amazon.CloudWatchLogs.Model;
using System;
using System.Collections.Generic;
using System.Threading.Tasks;

class CloudWatchLogsBatchSender
{
    private static readonly string _logGroupName = "Your-Target-Log-Group";
    private static readonly string _logStreamName = "Your-Target-Log-Stream";
    private static IAmazonCloudWatchLogs _cwLogsClient;

    static async Task Main(string[] args)
    {
        // 初始化客户端，默认读取本地AWS凭证（环境变量、凭证文件等）
        _cwLogsClient = new AmazonCloudWatchLogsClient(RegionEndpoint.USWest2); // 替换为你的AWS区域

        try
        {
            // 构造多条日志事件
            var batchLogs = new List<InputLogEvent>
            {
                new InputLogEvent
                {
                    Timestamp = DateTime.UtcNow,
                    Message = "[INFO] 系统初始化完成，当前版本：v1.2.3"
                },
                new InputLogEvent
                {
                    Timestamp = DateTime.UtcNow,
                    Message = "[WARN] 缓存连接池使用率达85%，建议扩容"
                },
                new InputLogEvent
                {
                    Timestamp = DateTime.UtcNow,
                    Message = "[ERROR] 数据库查询超时，SQL ID：query_001"
                }
            };

            // 获取当前日志流的序列令牌（日志流不存在则返回null）
            string sequenceToken = await GetCurrentSequenceToken();

            // 批量发送日志
            var response = await SendBatchLogs(batchLogs, sequenceToken);

            Console.WriteLine($"日志发送成功，下次发送请使用令牌：{response.NextSequenceToken}");
        }
        catch (Exception ex)
        {
            Console.WriteLine($"发送失败：{ex.Message}");
        }
        finally
        {
            await _cwLogsClient.DisposeAsync();
        }
    }

    /// <summary>
    /// 获取指定日志流的当前序列令牌
    /// </summary>
    private static async Task<string> GetCurrentSequenceToken()
    {
        try
        {
            var describeReq = new DescribeLogStreamsRequest
            {
                LogGroupName = _logGroupName,
                LogStreamNamePrefix = _logStreamName
            };

            var describeResp = await _cwLogsClient.DescribeLogStreamsAsync(describeReq);
            var targetStream = describeResp.LogStreams.Find(s => s.LogStreamName == _logStreamName);

            return targetStream?.UploadSequenceToken;
        }
        catch (ResourceNotFoundException)
        {
            // 日志流未创建，返回null即可
            return null;
        }
    }

    /// <summary>
    /// 批量发送日志事件到CloudWatch
    /// </summary>
    private static async Task<PutLogEventsResponse> SendBatchLogs(List<InputLogEvent> logs, string sequenceToken)
    {
        var putReq = new PutLogEventsRequest
        {
            LogGroupName = _logGroupName,
            LogStreamName = _logStreamName,
            LogEvents = logs,
            SequenceToken = sequenceToken
        };

        return await _cwLogsClient.PutLogEventsAsync(putReq);
    }
}

注意事项 #

• 单次调用最多发送1000条日志，且未压缩的总大小不能超过1MB
• 日志时间戳需在过去14天至未来2小时范围内，否则会被拒绝
• 高频调用可能触发限流，需重试并使用最新的序列令牌

内容的提问来源于stack exchange，提问作者Rahul Chauhan