I am able to run a query in CloudWatch logs with no issues...
filter eventName = 'SomeEvent' and responseElements.someId in ['string1', 'string2']
I am now trying to replicate the same in python because I have to do this for many ids.
via...
result = cw.filter_log_events(
logGroupName='/some-log-group',
startTime=start_time,
endTime=end_time,
filterPattern=filter_pattern,
limit=1000
)
where the filter patterns are defined below.
This works...
filter_pattern = { $.name = "SomeName" }
This does not...
ids = ['string1','string2','string3']
ids_pattern = '|'.join(ids)
filter_pattern = f'{{ $.name = "SomeName" && $.responseElements.someId like /{ids_pattern}/ }}'
Nor does this...
ids = ['string1','string2','string3']
ids_pattern = ','.join(ids)
filter_pattern = f'{{ $.name = "SomeName" && $.responseElements.someId in [{ids_pattern}] }}'
Error - when calling the FilterLogEvents operation: Invalid filter pattern
Documentation here... https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
Does not make it clear if either like
or in
is supported but wondering if this is the issue?
Bad documentation since it looks like in
or like
may not be supported while the errors do nothing to help figure that out.
Instead went with...
{ $.name = "SomeName" && ($.responseElements.someId = "string1" || $.responseElements.someId = "string2") }