Overview

A campus registration function rejects some submissions. Produce a small reproducible log dataset, then find the rejected request without scrolling through every log line. The code processes test events only; it does not create real registrations.

Architecture

A console test event invokes Lambda. The function prints one JSON application event, which its execution role writes to CloudWatch Logs. Logs Insights searches the function's log group.

AWS Lambda service icon

Use application logs to investigate code behavior. CloudTrail answers a different question: which identities made AWS API calls.

Prerequisites

A learning account allowed to create a Lambda function and its basic execution role, invoke it, and query/delete its logs.
A single region, and no sensitive data in the test events.

Steps

1. Create the function

Create cloudadhar-registration-check from scratch with Python 3.12 and a new basic execution role. Use the default architecture, 128 MB memory, and a three-second timeout. Keep the log format as Text for this example so the printed JSON appears directly in the message. Replace lambda_function.py with:

python

import json

def lambda_handler(event, context):
    student_id = event.get("studentId")
    valid = isinstance(student_id, str) and student_id.startswith("demo-")
    record = {
        "eventType": "registration_check",
        "requestId": context.aws_request_id,
        "status": "accepted" if valid else "rejected",
        "reason": "valid_demo_id" if valid else "invalid_demo_id"
    }
    print(json.dumps(record))
    return {"statusCode": 200 if valid else 400, "body": record["status"]}

Deploy the code. This return value is simply a test result, not an HTTP response served by a public endpoint.

2. Run three tests

Create a test event with {"studentId":"demo-001"} and invoke it twice. Create another event with {"studentId":"invalid"} and invoke it once. Expect two accepted results and one rejected result. All three function invocations succeed technically; rejection is an application outcome.

3. Open the logs

From the function's monitoring area, open its CloudWatch log group /aws/lambda/cloudadhar-registration-check. Allow time for delivery. Set retention to one day for this disposable lab.

4. Find the rejection

Open Logs Insights, select only this log group, choose the most recent 30 minutes, and run:

text

fields @timestamp, @message
| filter @message like /registration_check/
| filter @message like /rejected/
| sort @timestamp desc
| limit 20

Expect one matching application log if you invoked the invalid test once. Inspect its requestId and reason. Broaden the time window or check the region if there are no results.

5. Summarize your diagnosis

Record the input condition that caused rejection, the relevant request ID, and the code path responsible. Explain why checking only Lambda's Errors metric would miss this application-level rejection.

Verification

Valid synthetic IDs return accepted; an invalid ID returns rejected.
The query locates the rejected application event.
Logs contain no student personal information.
You can distinguish business rejection from an unhandled function error.

Cost and cleanup

Lambda invocations, log ingestion, storage, and scanned query data may incur charges. Keep the log group and query time range small. Delete the function, its dedicated log group, and its dedicated execution role after confirming no other resource uses the role. Deleting a Lambda function alone does not remove its log group.

Investigate a failed registration with Lambda logs