I’m using AWS CloudWatch Logs subscription filters to trigger a Lambda function based on certain log events. I want to trigger the Lambda only when both the words "fail" and "exception" appear in the same log message.
I’ve tried using the filter pattern ?fail ?exception, but it only matches logs that contain one of the words, not both.
Can someone explain how to write a CloudWatch Logs subscription filter that will match a log message containing both "fail" and "exception"? Is there a way to ensure that both words must appear in the same log message for the filter to trigger the Lambda function?
Thanks for the answer. Maybe you know how to make the word case-insensitive?
As of January 2025, I don't think there is a syntax for searching without considering uppercase and lowercase letters in the subscription filter. If you use "?", it becomes an OR condition, but in that case, you will not be able to use an AND condition, so your request will not be met.
If the log is space-delimited, I think you can use a filter pattern like the one below. However, I think that even in this case you need to format it in such a way that it includes all the pattern words to make it case sensitive. For example, it is not possible to distinguish between "Fail", "fail", and "FAIL", so these must be included in the filter pattern.