Filter VPC flow logs to check connection between RDS mySQL and EC2

Question

Connection between database and EC2 instance breaks at random times, even if there is 0 traffic and I have enabled VPC flow logs to figure out why. I can't seem to filter logs related to my RDS instance. I have tried filtering out logs according to my EC2 instance id, [let's say Instance ID is a123 and the filtered-out logs contain another instance ID, let's say b456     this is my custom flow log format: **${instance-id} ${srcaddr} ${srcport} ${pkt-srcaddr} ${pkt-src-aws-service} ${dstaddr} ${dstport} ${pkt-dstaddr} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path} ${action} ${log-status}**] and also port that my RDS instance uses, but it is not working.

Accepted Answer

Simply put double quotes around the instance id.

Answer

You can use the following filter pattern in **CloudWatch Logs** to search (all logs streams) for either of the two IP addresses in the **log group**, for example:
* 10.1.1.1 - server 1
* 10.2.2.2 - server 2

**like this:**

%10\.1\.1\.1|10\.2\.2\.2%

Simply update this with your server IPs.

See more syntax rules here: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html#matching-terms-events

Filter VPC flow logs to check connection between RDS mySQL and EC2

Relevant content