Search code examples
amazon-web-servicesamazon-cloudwatchcloudwatchamazon-cloudwatchlogs

CloudWatch Logs Filter case insensitive multiple terms or connected

I'm just trying to create an alarm based on CloudWatch Logs Filter which triggers on multiple terms (or connected, not and) and is case insensitive

Using "error warning" as pattern is not working

I'm looking for filter pattern reacting to all of the following errors and warnings:

ERROR: first sample
Error: second sample
error: third sample
{ ERROR: "fourth sample"}
{type: "error"}
WARNING: SOMETHING BAD!
{ WARNING: "fifth sample"}
Solution

  • Per the AWS Documentation concerning Filter and Pattern Syntax, you cannot use "error warning" to capture an "OR" relationship because:

    • You can specify multiple terms in a metric filter pattern, but all terms must appear in a log event for there to be a match.

    Or in other words, CloudWatch Log metric filters expect an "AND" relationship.

    Likewise:

    • Metric filters are case sensitive.

    So you'll be unable to achieve this with a single filter. You'll need a filter for each case-sensitive permutation of "error" and "warning" that you expect to write to Cloudwatch Logs.

    In order to set a single alarm on all of these filters, simply configure each filter to use the same CloudWatch metric. Here's an example from the AWS Console where each of my metric filters are targeted towards my LogMetric/test metric:

    AWS Console showing several metric filters using the same CloudWatch metric.

    I can then simply create a CloudWatch alarm based on the LogMetric/test metric to alarm on the sum of these distinct metric filters.