AWS CloudWatch filter for multiple log strings

Question

I am creating a line chart in a CloudWatch dashboard. I can create a line representing the frequency with which one string appears the logs, using a filter. But, I don't know how to create two or more such lines.

After selecting a log group, I run this query:

filter name = "first log string"
| stats count(*) as firstString by bin(1hour)

This generates counts of results that, in the Visiulization tab, are displayed as a line chart with a single line.

Now I want to add another line representing "second log string" on the chart. I assume I will have to modify the filter in some way, or add a second filter.

Here are some things that don't work:

• adding a second name to the filter
• trying filter @message or @name as this documentation suggests
• simply pasting in a modified duplicate of the query

Further, I seem to lack documentation that explains how filter is supposed to work. Search engines keep sending me back to this Filter And Pattern Syntax AWS document which dosen't appear to give any actual examples using filter.

Answer 1

To answer my own question, I had to use an array in my filter. I also used the sum() function instead of count().

filter name in ["first log string", "second log string"]
| fields name = "first log string" as first_string, name = "second log string" as second_string
| stats sum(first_string) as first_string, sum(second_string) as second_string by bin(1hour)

Now I have a line chart with two lines representing the frequency of two logged items