Pull a complete cloudwatch logstream to your local machine

pull_cloudwatch_log.sh

# usage bash pull_cloudwatch_log.sh <log-group name> <log-stream-name> [<output-file>]
LOG_GROUP="${1:-log-group-name}"
LOG_STREAM="${2:-log-stream-name}"
OUTFILE="${3:-output.log}"

echo "Fetching logstream: $LOG_STREAM"
LOGOUTPUT="$(aws logs get-log-events --log-group-name $LOG_GROUP --log-stream-name $LOG_STREAM --output text --start-from-head)"
echo "Flushing chunk on $OUTFILE"
echo "$LOGOUTPUT" >> $OUTFILE

OLD_TOKEN=
NEW_TOKEN=$(echo "$LOGOUTPUT" | head -n1 | grep -o 'f/.\+')

while [[ "$OLD_TOKEN" != "$NEW_TOKEN" ]]; do
    echo "Next token: $NEW_TOKEN"
    echo "Fetching logstream: $LOG_STREAM"
    LOGOUTPUT="$(aws logs get-log-events --next-token $NEW_TOKEN --log-group-name $LOG_GROUP --log-stream-name $LOG_STREAM --output text --start-from-head)"
    echo "Flushing chunk on $OUTFILE"
    echo "$LOGOUTPUT" >> $OUTFILE
    OLD_TOKEN=$NEW_TOKEN
    NEW_TOKEN=$(echo "$LOGOUTPUT" | head -n1 | grep -o 'f/.\+')
done