Metric filter for logs JSON data with @ property names

1

For Logs Insights, it seems rather straightforward to query/filter against JSON data with property names prefixed with '@'

| filter @@level like /Error/ and @@msgtxt in ["event 1", "event 2"]

However when it comes to defining filter patterns for custom metrics, the JSON property matching selector does not appear to like '@'

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

{ $.@msgtxt = "event 1" || $.@msgtxt = "event 2" }

will throw

An error occurred while testing the subscription filter.
Invalid character(s) in term '$.@'

How should the proper metric filter pattern be like?

Edited by: icelava on Oct 5, 2021 11:33 PM Typo

icelava
已提問 3 年前檢視次數 1413 次
3 個答案
0

The documentation does not explicitly state so, but OR filters can also apply to whole phrases instead of just standalone words.

?"Event 1" ?"Event 2"

So have to fall back to plain text-phrase matching instead of JSON selector matching.

Edited by: icelava on Oct 6, 2021 4:28 AM

icelava
已回答 3 年前
0

I need to filter on JSON properties with @ as a prefix as well. Can Amazon come out and explicitly say whether they don't support fields which start with special characters and that it was a significant oversight or give us a way around this? It's already painful to use this tool after coming from other log providers which support this or show logs from recent to oldest instead.

SD123
已回答 3 年前
0

Considering the fact that many frameworks, such as "Serilog", use the character @ as the prefix for the log properties, it is very unconvenient that AWS CloudWatch filters don't support this format.

已回答 7 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南