Filter pattern for cloud watch log group using aws-sdk

Question

I'm trying to fetch the cloud watch(log group) logs based upon a filter. On my yaml file, I've given the filter pattern as FilterPattern: "Success response". So after deploying the lambda function, it throws an error saying - Invalid Subscription filter pattern(Service:cloudWatchLogs, StatusCode: 400,...

The log looks like this -

{"info":"xxxxx", "message": "Success response","timeStamp": "2022-11-28 11:14 44:12", ......}

I want all the logs which has the word "Success response".

Note: I'm using Subscription filters with AWS Lambda.

Answer 1

You can use this:

FilterPattern: '{ $.message = "Success response" }'

Your logs are JSON formatted so $ will let you access the parsed version.

$.message will return the message field and the filter checks if it is equal to the string you provided.

If you want to filter for a generic pattern you can use this:

'{ $.message = "response -*" }'