AWS: Lambda Triggers from Cloudwatch Logs, using an OR in the filter

Question

I have been using this documentation but am unable to get it working exactly as intended: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

I would like a lambda triggered based on the CloudWatch Logs when they show either an error or a timeout.

Here's 2 example messages:

'message': '2021-04-14T20:48:20.344Z 1f562170-e507-4419-8875-2da228de0b86 Task timed out after 1.00 seconds\n\n'

'message': '[ERROR] Exception: say hello to my little friend\rTraceback (most recent call last):\r\xa0\xa0File "/var/task/lambda_function.py", line 6, in lambda_handler\r\xa0\xa0\xa0\xa0raise Exception("say hello to my little friend")\n'

I got it to work only with this filter pattern:

?ERROR ?Task

But it's not working when I try to scale it out to:

?ERROR ?Task timed out after

I believe the issue is that it's looking at "timed" "out" and "after" to be required.

I don't see anything in the documentation that would allow me to do an OR command and then wrap each side of the or into a grouped string of words.

If anyone has some advice that could be really helpful, thank you.

Answer 1

Trial and error brought a solution:

?"[ERROR]" ?"Task timed out after"