cloudwatch metric Filter Pattern doesn't match with the json logs

1
votes

I am trying to configure a custom metric for my service which will monitor the uptime of the service, I am trying to get the value of status code and raise an alarm if the value is 4* and 5* I am trying to match the statusCode using json filter patter but not able to get it correct 

 {
        "res": {
            "statusCode": 500
        },
        "req": {
            "url": "",
            "headers": {
                "host": "",
                "connection": "close",
                "user-agent": "",
                "accept-encoding": "gzip, compressed"
            },
            "method": "GET",
            "httpVersion": "1.1",
            "originalUrl": "",
            "query": {}
        },
        "responseTime": 1,
        "requestId": "",
        "level": "info",
        "message": "",
        "timestamp": ""
    }

my filter pattern is I tried these both but none of them worked {$.res.statusCode = 500}

{($.res.statusCode = 2*)||($.res.statusCode = 5*)}

I am trying to follow https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

2
amazon-cloudwatchamazon-cloudwatchlogsamazon-cloudwatch-metrics
I have this issue to. I even tried to use the example json data from the link you provided and when i use the filter pattern they use, it gives 0 matches. – Moddaman
@Moddaman see the answer – bhavesh

2 Answers

2
votes

It seems to be the issue with json when we copy paste the json doesn't work, if selected from Log Data to Test dropdown , the filter worked for me in this case.

0
votes

The answer that worked for me is the one in, AWS Cloudwatch Json Metric Filter Pattern

which quotes,

When using the Test Metric Filter feature in the AWS Console, each log event has to be in a separate line. You can still run the same test, but you have to remove all new lines from the sample data.