EDIT 2020-10-19
You must also grant CloudWatch logs permission to invoke your lambda function!
aws lambda add-permission \
--function-name "foo" \
--qualifier "56" \
--statement-id "Allow-invoke-foo-or-whatever" \
--principal "logs.us-east-42.amazonaws.com" \
--action "lambda:InvokeFunction" \
--source-arn "arn:aws:logs:us-east-1:123456789012:log-group:/ecs/my-prod-server:*" \
--source-account "123456789012"
Original answer
Still not sure if possible via console but I've found a solution using aws-cli. You can add version number at the end of the destination arn. For example, to send logs to foo
version 56
, do:
aws logs put-subscription-filter \
--log-group-name "/ecs/my-prod-server" \
--filter-name "BestFilter_ever" \
--filter-pattern "{$.level=*}" \
--destination-arn "arn:aws:lambda:us-east-42:123456789012:function:foo:56"