Why aren't my Amazon ECS container logs delivered to CloudWatch Logs?

Resolution

Modify the awslogs log driver

Add the logConfiguration parameter on the awslogs log driver in your task definition. For Amazon ECS tasks with multiple containers, configure the logConfiguration parameter for each container.

If you have an Amazon Elastic Compute Cloud (Amazon EC2) launch type, then update your Amazon ECS container instance to version 1.9.0 or later.

If your container instance doesn't use the Amazon ECS-optimized Amazon Machine Image (AMI), then run the following environment variable to start the container agent:

ECS_AVAILABLE_LOGGING_DRIVERS='["json-file","awslogs"]'

Note: Specify the awslogs log driver on the container instance.

For more information, see Installing the Amazon ECS container agent.

Add the necessary IAM role permissions

AWS Fargate launch type

Attach the AmazonECSTaskExecutionRolePolicy policy to your Amazon ECS task execution AWS Identity and Access Management (IAM) role. The policy includes the necessary logs:CreateLogStream and logs:PutLogEvents permissions. Or, create a custom IAM policy and include the necessary permissions.

Amazon EC2 launch type tasks without task execution IAM role

Attach the AmazonEC2ContainerServiceforEC2Role policy to the container instance IAM role. The policy contains the necessary logs:CreateLogStream and logs:PutLogEvents permissions. Or, create a custom IAM policy and include the necessary permissions.

Amazon EC2 launch type tasks with task execution IAM role

For the container agent configuration, update the ECS_ENABLE_AWSLOGS_EXECUTIONROLE_OVERRIDE parameter to true.

Note: The default value for the container agent parameter is true on Amazon ECS-optimized AMIs with version 1.16.0-1 or later and false on Windows.

Check the task configuration definition

If the log group specified in your task definition doesn't exist in CloudWatch Logs, logs can't be delivered. The awslogs log driver doesn't create the log group automatically unless you set awslogs-create-group to true.

To confirm the log group exists, complete the following steps:

1. Open the CloudWatch console.
2. In the navigation pane, choose Logs, and then choose Log groups.
3. Search for the log group name specified in your task definition.
4. If the log group doesn't exist, then choose Create log group.
5. Enter the log group name that matches your task definition.

Alternatively, add "awslogs-create-group": "true" to the options block in your task definition's logConfiguration to allow the log driver to create the log group automatically.

Note: Your IAM policy must include the logs:CreateLogGroup permission before you use awslogs-create-group. For more information, see Amazon ECS task execution IAM role.

Check the network configuration

If your task uses the awslogs log driver in an Amazon Virtual Private Cloud (Amazon VPC) without an internet gateway, then create an interface VPC endpoint for CloudWatch Logs. Choose com.amazonaws.Region.logs as the service.

Check container log-level configuration

The awslogs log driver passes the STDOUT and STDERR I/O streams from Docker to CloudWatch Logs.

To configure your logs, update your application to send the logs to STDOUT and STDERR I/O streams. Then during the container build, configure the application's log level through an environment variable or a configuration file.

Related information

Monitoring tools for Amazon ECS

How do I troubleshoot missing container logs for Amazon ECS or Amazon EKS?

Preventing log loss with non-blocking mode in the AWSLogs container log driver

PutAccountSetting