CloudWatch metric filter

0

I want to filter out the some metrics from the cloud watch logs that are published from EC2 instance and i have already metric filter but when i am filtering out the keyword "Err" with process name "pro_col_iww_yww_post300932059" it is giving correct result. But i want to filter keyword Err with 4 or 6 defined process name then how would i create that filter pattern.

What I need - : i want to search Err keyword with process names - pro_col_iww_yww_post300932059, pro_col_wqw_wtw_post300123222, pro_col_wsw_jww_post300121271, pro_col_fww_lww_post300481214.

Example of log event below. 20231106 153001.563|0|MEWE|Err|0|0>[]|tid:1285|pro_col_iww_yww_post300932059|DataTransferProperties|m_iComponentID=415034598 m_sRemoteSystemName=Resource.Collect.SFtpType153761345088823 m_iRemoteSystemID=415678669 transferType=0 AuditItem=AuditItem1:|Role1:|AuditItem2:|Role2:| FileNameDate=AuditDateGettingFrom:UNKOWN|FileMode:UNKOWN|StartPos:-1|EndPos:-1|Splitter:NO SPLITTER|Sequence:-1| MinStartTime=MinTimeGetMode:NOT PROVIDE|FileMode:UNKOWN|StartPos:-1|EndPos:-1|Splitter:NO SPLITTER|Sequence:-1|

Question - I want to filter keyword Err with process name as mentioned above(these are fixed name) from the log events which have Err.

asked 8 months ago454 views
3 Answers
2
Accepted Answer

Hi, sorry for the late reply. As we don't have an example of your logs and don't know your seletion criteria, we are flying blind and cannot be sure what would be the best possible syntax. Please find below an example that I hope could unblock you: Considering the following log messages:

2023-12-07 Some info for pro_col_iww_yww_post300932059 A message info
2023-12-07 Some info for pro_col_wqw_wtw_post300123222 Another message with other info
2023-12-07 Some info for pro_col_wsw_jww_post300121271 Again a message with other info
2023-12-07 Some info for pro_col_abc_jww_post300121271 Reject this message because the prefix abc is not allowed
2023-12-07 Some info for pro_col_wsw_jww_post123ABC123 Reject this message because the suffix id contains letters
2023-12-07 An Error message, we want it too

We want to keep messages 1, 2, 3 and 6 as per the comments I've added to the messages. One possible way (there are multiple ways, this is just an option) to filter those messages would be:

%Err|pro_col_[iwsq]{3}_[wtyj]{3}_post[\d]{9}%

Explanation:

  • the filter starts with % and ends with % => this is a Regex filter (no double quotes when using a regex filter!)
  • the filter has a first option then | as an OR then a second option
  • the second option to match has nested patterns: 3 letters exactly out of i,w,s,q for one part, 3 letters exactly from a different set of letters for the next part, and 9 decimals exactly at the end of the pattern we are matching on

In the examples you give above you seem to be using | but inside double quotes so this wouldn't be recognized as an OR, unless it's an actual character you're trying to match? Also, I don't see % around your expression if it's a regex you intend to craft, % is mandatory if it's a regex. I hope this example and explanation will fill the gap with what you need to be successful with your query.

profile pictureAWS
Jsc
answered 7 months ago
profile picture
EXPERT
reviewed a month ago
profile picture
EXPERT
reviewed 4 months ago
  • Hi thankyou for the suggestion. Please find the exact example below.

  • 20231106 153001.563|0|MEDE|Err|0|0>[]|tid:3385|pro_col_smsc_cdr_post300133060|DataTransferProperties|m_iComponentID=415038698 m_sRemoteSystemName=Resource.Collect.SFtpType153761300099823 m_iRemoteSystemID=415038669 transferType=0 AuditItem=AuditItem1:|Role1:|AuditItem2:|Role2:| FileNameDate=AuditDateGettingFrom:UNKOWN|FileMode:UNKOWN|StartPos:-1|EndPos:-1|Splitter:NO SPLITTER|Sequence:-1| MinStartTime=MinTimeGetMode:NOT PROVIDE|FileMode:UNKOWN|StartPos:-1|EndPos:-1|Splitter:NO SPLITTER|Sequence:-1| 20231106 153001.565|0|MEDE|Err|0|0>[]|tid:3385|pro_col_roam_cdr_post300124339|common|error code=150002000, file:CSFTPProtocol.cpp,line:1552,The expression(nullptr != m_pSession)execute error! 20231106 153001.565|0|MEDE|Err|0|0>[]|tid:3385|pro_col_gmsc_cdr_post300131221|MultiCollect153763300099868|error code=0, Init data object: Resource.Collect.SFtpType153761300099823 failed! 20231106 153001.565|0|MEDE|Err|0|0>[]|tid:3385|prs_col_BI_2meme300099867|MultiCollect153763300099868|error code=150012023, error description=You must add at least one active NE for the multi-collector:Component id=415038698 20231106 153001.565|0|MEDE|Err|0|0>[]|tid:3385|prs_col_BI_2Kruidvat300099867|common|error code=150002000, file:component_startup.cpp,line:43,The expression("0 == comptr->Init(tmpobject)")execute error! 20231106 153001.565|0|MEDE|Err|0|0>[]|tid:3385|pro_col_scg_cdr_post300124004|common|error code=150002000, file:CFlowengineService.cpp,line:65,The expression("0 == startup->Init()")execute

  • I want to create filter pattern for the below four process from the above logs events so it can print error(Err), messgae and below process names

    pro_col_smsc_cdr_post300133060 pro_col_roam_cdr_post300124339 pro_col_gmsc_cdr_post300131221 pro_col_scg_cdr_post300124004

  • 20231106 is the starting of the log event and according to this i have provided 6 log events in the above comment.

1

You might be able to create a metric filter by using some of these examples: https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html#cloudwatch-5

I'm not positive if that format only works for CloudTrail logs but it may help.

Here is a link to the filter and pattern syntax: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html#matching-terms-unstructured-log-events

The CloudTrail is in the JSON format but using the unstructured log events syntax might help.

Tom B
answered 8 months ago
  • Hi thanks for the suggestion. But it is possible to grep Err with multiple process name like - "Err" process-name 1 or process-name 2 or process-name 3 so on..... in a single metric filter. For more clarity - I am thinking about the filter same like we have in SQL query with WHERE clause with OR conditon. Can you suggest me in this way.

  • I have tried below filter but no results and some have errors. These are the filter patterns |Err|(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)| \|Err\|(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)\| "|Err|(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)|" "|Err|.(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271).|" "Err.*pro_col_iww_yww_post300932059" ".Err.pro_col_iww_yww_post300932059." "Err.pro_col_iww_yww_post300932059" "Err.(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)." "Err.pro_xxx_pmdm_ghgfgf_order_post000000.|Err.pro_col_fdjhc_jksav_post2936478."

  • Hi, Do you have any update on this?

1

Hi, it might help if you shared your existing filter. If you look into the second link shared by Tom B and look at the space delimited log events example, it shows a way to link together conditions that seems to match your need. As indicated on that page: You also can use the logical operators AND (&&) and OR (||) to create compound expressions.

Note however that you can also use wildcards. In the same example I'm referring to, you can see some filters such as request =.html, status_code = 4* - it might also be useful in your case if you want to match an unbounded list of process names?

profile pictureAWS
Jsc
answered 8 months ago
  • I have tried below filter but no results and some have errors. These are the filter patterns |Err|(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)| |Err|(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)| "|Err|(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)|" "|Err|.(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271).|" "Err.*pro_col_iww_yww_post300932059" ".Err.pro_col_iww_yww_post300932059." "Err.pro_col_iww_yww_post300932059" "Err.(pro_col_iww_yww_post300932059|pro_col_wqw_wtw_post300123222|pro_col_wsw_jww_post300121271)." "Err.pro_xxx_pmdm_ghgfgf_order_post000000.|Err.pro_col_fdjhc_jksav_post2936478."

  • Or is there any another way to filter the metrics from the log events ?

  • Hi, Do you have any update on this?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions