7

Is it possible to create a metric that extracts a numeric value from a string in Cloudwatch logs so I can graph / alarm it?

For example, the log may be: 20190827 1234 class: File size: 64MB

I realize I can capture the space delimited fields by using a filter pattern like: [date, time, class, word1, word2, file_size]

And file_size will be "64MB", but how do I convert that to a numeric 64 to be graphed?

Bonus question, is there any way of matching "File size:" as one field instead of creating a field for each space delimited word?

Michael
  • 101
  • 1
  • 6

1 Answers1

1

Use abs to cast to number, or any other numberic function

Using Glob Expressions

fields @message
| parse @message "File size: *MB" as size
| filter abs(size)<64
| limit 20

Using Regular Expressions

fields @message
| parse @message /File size:\s+(?<size>\d+)MB/
| filter abs(size)<64
| limit 20

To learn how glob or regular expression can be used, see Cloud Watch Logs Query Syntax

Pradeep Singh
  • 432
  • 5
  • 11
  • 1
    This has nothing to do with metric filters that the question is about. There is no doubt Logs Insights have powerful query language but the question was about extracting a value from a log to create a metric, which is different. – avepr Oct 27 '22 at 11:12