CODEWITHSUNDEEP
amazon-cloudwatch
void
void

Reputation: 355

cloudwatch metric filter OR and exclude

I am wondering if it is possible to use both OR and exclude syntax in cloudwatch metric filter. I have been reading the documentation and trying different combination with no luck.

Here is my test data:

[ABC] - ERROR 2020-01

[ABC] - ERROR 2020-01

ERROR 2020-01

WARN

2020-01-29T02:13:08.342-08:00

I wounder like to find entries that contains ERROR or WARN but not ABC I tried:

?ERROR ?WARN - "ABC"

but it won't work.

Thanks

Upvotes: 10

Views: 7220

Answers (1)

redgeoff
redgeoff

Reputation: 3341

I had to use something like [(w1="*ERROR*" || w1="*WARN*") && w1!="*ABC*"]

Hacky, but it worked!

Upvotes: 16

Related Questions