Metric filter for logs JSON data with @ property names

1

For Logs Insights, it seems rather straightforward to query/filter against JSON data with property names prefixed with '@'

| filter @@level like /Error/ and @@msgtxt in ["event 1", "event 2"]

However when it comes to defining filter patterns for custom metrics, the JSON property matching selector does not appear to like '@'

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

{ $.@msgtxt = "event 1" || $.@msgtxt = "event 2" }

will throw

An error occurred while testing the subscription filter.
Invalid character(s) in term '$.@'

How should the proper metric filter pattern be like?

Edited by: icelava on Oct 5, 2021 11:33 PM Typo

icelava
已提问 3 年前1413 查看次数
3 回答
0

The documentation does not explicitly state so, but OR filters can also apply to whole phrases instead of just standalone words.

?"Event 1" ?"Event 2"

So have to fall back to plain text-phrase matching instead of JSON selector matching.

Edited by: icelava on Oct 6, 2021 4:28 AM

icelava
已回答 3 年前
0

I need to filter on JSON properties with @ as a prefix as well. Can Amazon come out and explicitly say whether they don't support fields which start with special characters and that it was a significant oversight or give us a way around this? It's already painful to use this tool after coming from other log providers which support this or show logs from recent to oldest instead.

SD123
已回答 3 年前
0

Considering the fact that many frameworks, such as "Serilog", use the character @ as the prefix for the log properties, it is very unconvenient that AWS CloudWatch filters don't support this format.

已回答 7 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则