Exclude some custom filter pattern to give alert.

You can modify your CloudWatch Logs filter pattern to exclude specific error patterns while still capturing the ones you want to be alerted on. The CloudWatch agent configuration supports both include and exclude filter types.

For your specific case, you could modify your metric filter pattern to use a combination of filters that include your general error patterns but exclude the specific error patterns you don't want alerts for.

For example, if you want to exclude errors containing a specific message like "ExpectedError", you could use a pattern like:

{ ($.log_level = "error" || $.log_level = "ERROR" || $.level = "error" || $.level = "ERROR") && ($.message != "ExpectedError") }

Alternatively, with CloudWatch Logs subscription filters, you can use selection criteria with the "NOT IN" operator to exclude specific log groups from your filter.

For Lambda functions that process logs from sources like Apache Kafka or Amazon MSK, you can also implement event filtering using the "anything-but" pattern to ignore specific error messages. This approach allows you to filter out known error messages that don't require alerts.

These filtering approaches allow you to reduce false alerts without requiring changes from your development team.
Sources
Account-level subscription filters - Amazon CloudWatch Logs
Manually create or edit the CloudWatch agent configuration file - Amazon CloudWatch
Using event filtering with a self-managed Apache Kafka event source - AWS Lambda
Using event filtering with an Amazon MSK event source - AWS Lambda