Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

CloudWatch Logs Subscription Filter Pattern to Match Multiple Words in Same Log Message

0

I’m using AWS CloudWatch Logs subscription filters to trigger a Lambda function based on certain log events. I want to trigger the Lambda only when both the words "fail" and "exception" appear in the same log message. I’ve tried using the filter pattern ?fail ?exception, but it only matches logs that contain one of the words, not both. Can someone explain how to write a CloudWatch Logs subscription filter that will match a log message containing both "fail" and "exception"? Is there a way to ensure that both words must appear in the same log message for the filter to trigger the Lambda function?

Topics
ServerlessManagement & GovernanceCompute
Tags
CloudWatch Logs InsightsAmazon CloudWatch LogsAmazon CloudWatch AlarmsAWS Lambda
Language
English
asked a year ago507 views
1 Answer
0
Accepted Answer

Hello.

I think you can filter logs that include "fail" and "exception" using the filter pattern below.

fail exception

An example can be found in the documentation below.
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
a

EXPERT
answered a year ago
EXPERT
reviewed 10 months ago
EXPERT
reviewed a year ago
  • Tatev
    a year ago

    Thanks for the answer. Maybe you know how to make the word case-insensitive?

  • Riku_Kobayashi EXPERT
    a year ago

    As of January 2025, I don't think there is a syntax for searching without considering uppercase and lowercase letters in the subscription filter. If you use "?", it becomes an OR condition, but in that case, you will not be able to use an AND condition, so your request will not be met. a

    If the log is space-delimited, I think you can use a filter pattern like the one below. However, I think that even in this case you need to format it in such a way that it includes all the pattern words to make it case sensitive. For example, it is not possible to distinguish between "Fail", "fail", and "FAIL", so these must be included in the filter pattern.

    [(mes="*fail*" && mes="*exception*" || mes="*FAIL*" && mes="*EXCEPTION*")]

    a

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content