1import logging
2
3logger = logging.getLogger()
4logger.setLevel(logging.INFO)
5
6
7def handler(event, context):
8    logger.info("single event with\nmultiple lines\nline three")
9    logger.info("another event")
10    return {"ok": True}

1export const handler = async () => {
2  try {
3    throw new Error("database timeout");
4  } catch (err) {
5    console.error("Operation failed", err);
6    throw err;
7  }
8};

1import json
2import logging
3import uuid
4
5logger = logging.getLogger()
6logger.setLevel(logging.INFO)
7
8
9def log_event(level: str, message: str, request_id: str) -> None:
10    payload = {
11        "level": level,
12        "message": message,
13        "requestId": request_id,
14    }
15    logger.info(json.dumps(payload, separators=(",", ":")))
16
17
18def handler(event, context):
19    log_event("INFO", "processing started", context.aws_request_id)
20    return {"status": "ok", "id": str(uuid.uuid4())}

fields @timestamp, @message
| filter message like /processing/ | sort @timestamp desc | limit 20 ``` With plain multi-line text, regex parsing becomes more fragile. ## Size and Truncation Considerations CloudWatch Logs has event size limits. Very large multi-line messages can be truncated or split by runtime behavior. Instead of emitting one huge block, prefer concise structured entries for each logical step. Also log correlation ids such as request id, order id, or user id in every event so related records are easy to reconstruct. ## Operational Recommendations Use log levels consistently and avoid verbose debug logs in hot paths unless sampling is enabled. High-volume multi-line logs increase ingestion cost and make dashboards noisy. For critical failures, log one structured summary and include enough identifiers to fetch full traces from distributed tracing tools. When teams need exception details, capture stack trace fields as structured text values rather than dumping huge raw blocks repeatedly. ## Common Pitfalls A common pitfall is assuming every visual line in CloudWatch console is a separate event. Another issue is mixing multiline human logs with JSON logs in the same function, which complicates parsing and metrics extraction. Teams also omit request identifiers, making it hard to correlate events from retries and concurrent invocations. Finally, logging entire payloads can leak sensitive data and increase costs, so sanitize and minimize logged fields. ## Summary * Lambda application logs are shipped to CloudWatch as log events. * One logging call usually creates one event, even if message contains newlines. * Multi-line stack traces are useful for debugging but harder to query at scale. * Prefer one-line structured JSON logs for analytics and alerting. * Add correlation ids and keep log volume controlled for reliability and cost.