CloudWatch Template - Metric Filter with a colon

Question

I'm trying to create a metric filter in a CloudWatch template which includes a colon:

e.g.

          
  TotalLocationFound:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: "abc_found: True"
      LogGroupName: "/aws/lambda/blah"
      MetricTransformations: 
        - 
          MetricValue: "1"
          MetricNamespace: "ProductionClient"
          MetricName: "TotalAbcFound"

It seems to take issue with the filter pattern. I can use that same pattern from the console but when I deploy using CloudWatch command line I get this error:

Invalid metric filter pattern (Service: AWSLogs; Status Code: 400; Error Code: InvalidParameterException

Playing with it seems to point to the issue being the :

Thanks

Answer 1

You should try with quotation in the filter pattern. From docs:

Metric filter terms that include characters other than alphanumeric or underscore must be placed inside double quotes ("").

This the FilterPattern could be:

 FilterPattern: '"abc_found: True"'

You may try different ways of escaping double quotes in CloudFormation if this does not work as expected.

Answer 2

As mentioned already, if you want to include characters other than alphanumeric or underscore in your FilterPattern, it must be placed inside double quotes. If you are creating this resource via CloudFormation, then you will also need to escape the enclosing quotations as well.

For example, to achieve a FilterPattern of:

[::Application.Services.Unhealthy::]

In YAML CloudFormation the FilterPattern property should be:

FilterPattern: "\"[::Application.Services.Unhealthy::]\"" 

Full YAML CloudFormation for this resource would look something like this:

UnHealthyMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:  
        FilterPattern: "\"[::Application.Services.Unhealthy::]\"" 
        LogGroupName: /aws/lambda/my-lambda
        MetricTransformations: 
            - 
                MetricValue: 1
                MetricNamespace: "health/dev" 
                MetricName: "Unhealthy"