CloudWatch | Filter by a string contained in a log stream name

Question

Hello everyone,

CloudWatch logs have the following log group fields:
* Timestamp
* Ingestion time
* Message
* Event ID
* Log stream name

![log example](/media/postImages/original/IMShDK5W8QSlCjO_Fkdo-oSQ)

Log fields are inside square brackets and separated by arrows. I would like to exclude logs that contain a particular string in the log field name, underlined red, for example "driver". I tried to do it from the console but the console allows filtering by JSON or text message and message attributes only.

**How can I create a metric filter either from aws console or aws cli to exclude logs produced by the log stream that contains string "driver" in the name**?

Thank you

Answer

Hello,

Thank you for reaching out.

To exclude  terms in log events using metric filters, you can use the "Not Equal" symbol ("!=") before the term or terms which you want to exclude. For example to exclude the term "driver", you can use the filter below:

[w1!=driver, w2].

[+] https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html#pattern-matching-space-delimited

The above filter matches all other logs but excludes the log events with the term "driver".

You can test using the symbol in your logs and confirm if this works for you. If you have any challenges, I would recommend opening a case with support and share the sample logs for further insight.

CloudWatch | Filter by a string contained in a log stream name

Relevant content