29

I'm following the instructions here https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

but it's not working as i'm expecting it to.

I currently have the following cloudwatch log subscription filter pattern: ? "UNKNOWN_TOPIC_OR_PARTITION" ? " SEVERE " ? " severe " ? " FATAL " ? " fatal " - "closing session"

I would like to match any patter with " fatal " whilst excluding "closing session" from the results.

However, the above filter is matching other log output:

enter image description here

Ebrahim Moshaya
  • 727
  • 3
  • 11
  • 23

3 Answers3

26

You can't with event filter in CloudWatch... but you can with Logs Insights

CloudWatch -> CloudWatch Logs -> Logs Insights

Or

CloudWatch -> CloudWatch Logs -> Log groups -> [your service logs] -> [Button Logs Insights]

Logs Insights

Logs Insights UI

  1. Log service (you need to pick what logs of your services will to track
  2. In this part you can select the range of time.
  3. Here you have your querybox and here you can put querys like an SQL

So in your case you can with this in the query box

fields @timestamp, @message
| sort @timestamp desc
| filter @message like /SEVERE|severe|FATAL|fatal|closing session/

Now click on run query and you will see only logs that you want with that filters.

Derek Menénedez
  • 2,003
  • 11
  • 20
12

Try this Filter pattern:

[(w1="*UNKNOWN_TOPIC_OR_PARTITION*" || w1="*SEVERE*" || w1="*severe*" || w1="*FATAL*" || w1="*fatal*") && w1!="*closing session*"]
Slava Rozhnev
  • 9,510
  • 6
  • 23
  • 39
Ivan
  • 139
  • 1
  • 5
  • This works! But out of curiosity… where is that syntax documented? – Daniel Bang Nov 24 '22 at 20:29
  • 1
    @DanielBang you can find more details here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html. Section: Using pattern matching to match terms in space-delimited log events – Ivan Nov 28 '22 at 18:32
  • Thanks! I actually looked at that document before coming here but didn’t get to that part. – Daniel Bang Nov 30 '22 at 21:33
  • I have similar question. https://stackoverflow.com/questions/74995839/double-quotes-are-not-getting-added-on-filterpattern-aws-subscription-filter/74996040#74996040 – raj basilio Jan 03 '23 at 18:08
3

This bit, in combination with all the ORs, is causing you problems - "closing session". Try removing it a seeing if the rest is matching as expected.

I don't know the syntax to get what you need in a single filter, but to get the same result you can create a separate log filter for each string you want to match. In this case that would be:

  • "UNKNOWN_TOPIC_OR_PARTITION" - "closing session"
  • " SEVERE " - "closing session"
  • " severe " - "closing session"
  • " FATAL " - "closing session"
  • " fatal " - "closing session"

Now you have 5 different metrics. You can use metric math to sum them up, which will give you the metric you need. See here on how to use metric math:

Dejan Peretin
  • 10,891
  • 1
  • 45
  • 54
  • I'm trying to combine all that into a single filter and can't get it to work. So far I' tried: ? "UNKNOWN_TOPIC_OR_PARTITION" - "closing session" ? " SEVERE " - "closing session" ? " severe " - "closing session" ? " FATAL " - "closing session" ? " fatal " - "closing session" – Ebrahim Moshaya May 28 '19 at 10:46
  • My answer is to split it into multiple filters. Not sure how to get it in one filter. – Dejan Peretin May 28 '19 at 12:24
  • can't split... you can only have a single cloudwatch log filter subscription per log group which can't be changed.... https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.html – Ebrahim Moshaya May 30 '19 at 14:05
  • You are creating metric filters, not subscription filters. Limit is 100. – Dejan Peretin May 30 '19 at 20:49
  • Nope, i'm creating subscription cloudwatch filter not metric filter – Ebrahim Moshaya May 31 '19 at 21:18
  • 1
    Edit the question then to say so. You have more flexibility in that case, you can do extra processing in the lambda. – Dejan Peretin Jun 01 '19 at 04:59