9

When creating an AWS CloudWatch Log Metric Filter, how would you match terms in JSON Log Events where the key has a character space in the name?

For example, let's assume there's a log line with JSON element like the following...

{"Event":"SparkListenerLogStart","Spark Version":"2.4.0-SNAPSHOT"}

How would you reference the "Spark Version"? $."Spark Version", $.Spark Version, $.Spark\ Version, and $.[Spark Version] don't work.

I couldn't find the answer in the AWS Filter and Pattern Syntax documentation.

Max
  • 458
  • 3
  • 10

1 Answers1

7

At the time of writing, this is not possible. AWS will probably fix that at some point, but for now the only workaround would be to use the non-JSON syntax and search for the exact string. The following filter:

"\"Spark Version\":\"2.4.0-SNAPSHOT\""

will match:

{"Event":"SparkListenerLogStart","Spark Version":"2.4.0-SNAPSHOT"}
Daniel Vassallo
  • 337,827
  • 72
  • 505
  • 443