CODEWITHSUNDEEP
loggingamazon-web-servicesamazon-cloudwatch
GentlemanCoder
GentlemanCoder

Reputation: 577

AWS Cloudwatch Metric Filters: are they actually case-insensitive?

The AWS documentation states that Cloudwatch metric filters are case-sensitive, so I created 3 Cloudwatch Logs metrics, with filter patterns "ERROR", "Error", and "error", to ensure that I am informed of any errors written to my log files no matter the source.

When I tested the metrics by forcing an error that resulted in the word "ERROR" to appear in a log, all 3 metrics were triggered, when I only expected the one with filter "ERROR" to trigger. Does this mean that the filters are actually case-insensitive, contrary to the documentation? This would clearly be handy (fewer metrics), but I want to be sure first. TIA

Upvotes: 3

Views: 4152

Answers (1)

tpolyak
tpolyak

Reputation: 1239

They are case-sensitive, but metric generation can be different based on your metric filter setup:

  • If you have three filters publishing to separate metrics e.g. LogMetrics/Metric1, LogMetrics/Metric2, LogMetrics/Metric3 then the entries with different casing should be collected into different metrics
  • On the other hand, if you have set up your filters to use the same metric then all log entries will be collected into this metric.

It depends on your use case which way you set up your filters. In your case collecting all error messages to one metric is probably better because you can even define an alarm on that metric if the number of errors goes above a given threshold.

To verify that patterns are case sensitive you can test them by:

Using CloudWatch Console:

  • Go to https://console.aws.amazon.com/cloudwatch/home#logs:
  • Select a log group
  • Click on Create Metric Filter
  • On this page you can test any pattern against your log streams or against any custom text content that you enter to the text area. It will show the number of matches, the extracted values, etc.

Using TestMetricFilter API call:

Upvotes: 4

Related Questions