CODEWITHSUNDEEP
amazon-web-servicesamazon-cloudwatchcloudwatchamazon-cloudwatchlogs
Manuel
Manuel

Reputation: 9522

CloudWatch Logs Filter case insensitive multiple terms or connected

I'm just trying to create an alarm based on CloudWatch Logs Filter which triggers on multiple terms (or connected, not and) and is case insensitive

Using "error warning" as pattern is not working

I'm looking for filter pattern reacting to all of the following errors and warnings:

ERROR: first sample
Error: second sample
error: third sample
{ ERROR: "fourth sample"}
{type: "error"}
WARNING: SOMETHING BAD!
{ WARNING: "fifth sample"}

Upvotes: 16

Views: 34528

Answers (4)

Dominus.Vobiscum
Dominus.Vobiscum

Reputation: 847

In some simple cases, it might help to use regex: %[Ee]rror%

Upvotes: 0

Eduardo Lucio
Eduardo Lucio

Reputation: 2477

Let's present two ways to solve the problem...

I - Using filters (Log groups)

  1. Go to AWS CloudWatch;
  2. Click on "Log groups" ("Logs");
  3. Search for the desired log group;
  4. Select the desired log group;
  5. Click on "Search log group";
  6. Apply the desired filter in the relevant field and other desired search parameters.

FILTER EXAMPLE

?"ERROR" ?"Error" ?"error" ?"EXCEPT" ?"Except" ?"except"

NOTE: Allows you to search multiple cases - workaround for "case insensitive" - and by desired string part. The connector between the terms will be "OR".

II - Using queries (Logs Insights)

  1. Go to AWS CloudWatch;
  2. Click on "Logs Insights" ("Logs");
  3. Search for the desired log group;
  4. Select the desired log group;
  5. Insert your query;
  6. Apply other desired search parameters;
  7. Click on "Run query".

QUERY EXAMPLE

fields @timestamp, @message
| filter @message like /(?i)(error|except)/
| sort @timestamp desc
| limit 20

NOTE: Allows you to search case insensitive and by desired string part. The connector between the terms will be "OR".

Thanks! 🤗

[Ref(s).: https://stackoverflow.com/a/52828678/3223785 , https://bneijt.nl/blog/cloudwatch-case-insensitive-like-filter/ , https://stackoverflow.com/a/58377451/3223785 ]

Upvotes: 18

Sach
Sach

Reputation: 423

If you need to filter upon some strings you can OR them as follows:

?"String1" ?"String2"

and so on. Try it.

Upvotes: 28

Anthony Neace
Anthony Neace

Reputation: 26023

Per the AWS Documentation concerning Filter and Pattern Syntax, you cannot use "error warning" to capture an "OR" relationship because:

  • You can specify multiple terms in a metric filter pattern, but all terms must appear in a log event for there to be a match.

Or in other words, CloudWatch Log metric filters expect an "AND" relationship.

Likewise:

  • Metric filters are case sensitive.

So you'll be unable to achieve this with a single filter. You'll need a filter for each case-sensitive permutation of "error" and "warning" that you expect to write to Cloudwatch Logs.

In order to set a single alarm on all of these filters, simply configure each filter to use the same CloudWatch metric. Here's an example from the AWS Console where each of my metric filters are targeted towards my LogMetric/test metric:

AWS Console showing several metric filters using the same CloudWatch metric.

I can then simply create a CloudWatch alarm based on the LogMetric/test metric to alarm on the sum of these distinct metric filters.

Upvotes: 8

Related Questions