无法通过.ebextensions/logs.config将Elastic Beanstalk自定义日志导入CloudWatch

现有配置的核心问题 #

• 配置1、2仅针对Elastic Beanstalk日志打包功能（用于通过eb logs命令下载日志），和CloudWatch日志同步完全无关，因此不会创建CloudWatch日志组。
• 配置3方向正确（基于awslogs服务实现日志推送），但存在多处疏漏：
  • 缺失faust_worker.stdout.log的日志配置条目
  • 未确保EC2实例的IAM角色具备CloudWatch日志推送权限
  • 服务启动命令未考虑服务未初始化的场景
  • 未处理日志文件的读取权限问题

修正后的完整配置 #

packages:
  yum:
    awslogs: []

files:
  "/etc/awslogs/awscli.conf":
    mode: "000600"
    owner: root
    group: root
    content: |
      [plugins]
      cwlogs = cwlogs
      [default]
      region = `{"Ref":"AWS::Region"}`

  "/etc/awslogs/config/celery_logs.conf":
    mode: "000600"
    owner: root
    group: root
    content: |
      [/var/log/celery_beat.stdout.log]
      log_group_name = `/aws/elasticbeanstalk/${AWSEB_ENVIRONMENT_NAME}/var/log/celery_beat.stdout.log`
      log_stream_name = {instance_id}
      file = /var/log/celery_beat.stdout.log
      datetime_format = %Y-%m-%d %H:%M:%S

      [/var/log/celery_flower.stdout.log]
      log_group_name = `/aws/elasticbeanstalk/${AWSEB_ENVIRONMENT_NAME}/var/log/celery_flower.stdout.log`
      log_stream_name = {instance_id}
      file = /var/log/celery_flower.stdout.log
      datetime_format = %Y-%m-%d %H:%M:%S

      [/var/log/celery_worker.stdout.log]
      log_group_name = `/aws/elasticbeanstalk/${AWSEB_ENVIRONMENT_NAME}/var/log/celery_worker.stdout.log`
      log_stream_name = {instance_id}
      file = /var/log/celery_worker.stdout.log
      datetime_format = %Y-%m-%d %H:%M:%S

      [/var/log/faust_worker.stdout.log]
      log_group_name = `/aws/elasticbeanstalk/${AWSEB_ENVIRONMENT_NAME}/var/log/faust_worker.stdout.log`
      log_stream_name = {instance_id}
      file = /var/log/faust_worker.stdout.log
      datetime_format = %Y-%m-%d %H:%M:%S

commands:
  01_set_log_permissions:
    command: chmod 644 /var/log/celery_*.stdout.log /var/log/faust_worker.stdout.log || true
  02_enable_awslogs:
    command: systemctl enable awslogsd.service
  03_restart_awslogs:
    command: systemctl restart awslogsd.service || systemctl start awslogsd.service

关键排查步骤 #

1. 验证IAM角色权限
   找到Beanstalk实例绑定的IAM角色，确认附加了包含以下权限的策略：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogGroup",
                   "logs:CreateLogStream",
                   "logs:PutLogEvents",
                   "logs:DescribeLogStreams"
               ],
               "Resource": "arn:aws:logs:*:*:*"
           }
       ]
   }
   

2. 检查awslogs服务状态

   • 登录实例执行systemctl status awslogsd，确认服务正常运行
   • 查看服务日志tail -f /var/log/awslogs.log，排查配置错误、权限报错等问题

3. 确认日志文件状态
   执行ls -l /var/log/celery_*.stdout.log /var/log/faust_worker.stdout.log，确保文件存在且其他用户具备读取权限

内容的提问来源于stack exchange，提问作者jack.odonoghue