diff --git a/aws/logs_monitoring/lambda_function.py b/aws/logs_monitoring/lambda_function.py
index c4b4a26fc..86df8453e 100644
--- a/aws/logs_monitoring/lambda_function.py
+++ b/aws/logs_monitoring/lambda_function.py
@@ -329,7 +329,11 @@ def extract_ddtags_from_message(event):
 
         # Extract service tag from message.ddtags if exists
         if "service" in extracted_ddtags:
-            event[DD_SERVICE] = next(tag[8:] for tag in extracted_ddtags.split(",") if tag.startswith("service:"))
+            event[DD_SERVICE] = next(
+                tag[8:]
+                for tag in extracted_ddtags.split(",")
+                if tag.startswith("service:")
+            )
             event[DD_CUSTOM_TAGS] = ",".join(
                 [
                     tag
diff --git a/aws/logs_monitoring/tests/test_lambda_function.py b/aws/logs_monitoring/tests/test_lambda_function.py
index 6a573398d..3e81bab45 100644
--- a/aws/logs_monitoring/tests/test_lambda_function.py
+++ b/aws/logs_monitoring/tests/test_lambda_function.py
@@ -317,9 +317,7 @@ def test_extract_trace_payload_valid_trace(self):
 
 
 class TestMergeMessageTags(unittest.TestCase):
-    message_tags = (
-        '{"ddtags":"service:my_application_service,custom_tag_1:value1"}'
-    )
+    message_tags = '{"ddtags":"service:my_application_service,custom_tag_1:value1"}'
     custom_tags = "custom_tag_2:value2,service:my_custom_service"
 
     def test_extract_ddtags_from_message_str(self):
@@ -361,7 +359,13 @@ def test_extract_ddtags_from_message_dict(self):
 
     def test_extract_ddtags_from_message_service_tag_setting(self):
         loaded_message_tags = json.loads(self.message_tags)
-        loaded_message_tags["ddtags"] = ",".join([tag for tag in loaded_message_tags["ddtags"].split(",") if not tag.startswith("service:")])
+        loaded_message_tags["ddtags"] = ",".join(
+            [
+                tag
+                for tag in loaded_message_tags["ddtags"].split(",")
+                if not tag.startswith("service:")
+            ]
+        )
         event = {
             "message": loaded_message_tags,
             "ddtags": self.custom_tags,
diff --git a/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_custom_tags.json~snapshot b/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_custom_tags.json~snapshot
index 42f0de013..674812320 100644
--- a/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_custom_tags.json~snapshot
+++ b/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_custom_tags.json~snapshot
@@ -14,7 +14,7 @@
           },
           "ddsource": "cloudwatch",
           "ddsourcecategory": "aws",
-          "ddtags": "custom_tag1:value1,custom_tag2:value2,forwarder_memorysize:1536,forwarder_version:<redacted from snapshot>,forwardername:test",
+          "ddtags": "forwardername:test,forwarder_memorysize:1536,forwarder_version:<redacted from snapshot>,custom_tag1:value1,custom_tag2:value2",
           "host": "testLogGroup",
           "id": "eventId1",
           "message": "{\"message\": \"hello world\"}",
diff --git a/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_service_tag.json~snapshot b/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_service_tag.json~snapshot
index 4a4bfee20..a5bc3bf90 100644
--- a/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_service_tag.json~snapshot
+++ b/aws/logs_monitoring/tools/integration_tests/snapshots/cloudwatch_log_service_tag.json~snapshot
@@ -14,7 +14,7 @@
           },
           "ddsource": "cloudwatch",
           "ddsourcecategory": "aws",
-          "ddtags": "forwarder_memorysize:1536,forwarder_version:<redacted from snapshot>,forwardername:test,service:myservice",
+          "ddtags": "forwardername:test,forwarder_memorysize:1536,forwarder_version:<redacted from snapshot>,service:myservice",
           "host": "testLogGroup",
           "id": "eventId1",
           "message": "{\"message\": \"hello world\"}",