Double quotes are not getting added on FilterPattern - AWS Subscription filter

Question

I want to use the following filter pattern - "error-res-received ". So on the configuration yaml file, I have have given FilterPattern: "\"error-res-received \"". But after deploying the lambda with subscription filter, When I check it on cloud watch > log group > subscription filters, the filter pattern is as error-res-received(double quotes are missing). So now, it's only picking up the logs which has word only error in it and excluding the words res and received. How can solve this issue? I need the logs which match this sentence "error-res-received".

Synaesthesia

Are you sure FilterPattern: "\"error-res-received \"" did not work? I just tried it and it worked for me? Do you want the result to match the exact phrase of error-res-received or do you want the result to match the phrase with quotes? – Akela

I want exact error-res-received phrase to match. I was using this - docs.aws.amazon.com/AmazonCloudWatch/latest/logs/… – Synaesthesia

Answer 1

To Match exact phrases

The following code snippet shows an example of a filter pattern that returns log events where messages contain the exact phrase INTERNAL SERVER ERROR.

"INTERNAL SERVER ERROR"

The filter pattern returns the following log event message:

[ERROR 500] INTERNAL SERVER ERROR

To Match everything

You can match everything in your log events with double quotation marks. The following code snippet shows an example of a filter pattern that returns all log events.

" "

In your case, "error-res-received ", there is extra space at end which might make it to match everything.

Chloramine

"error-res-received " - I have tested this pattern on subscription filter and it worked fine. I'm declaring filter pattern on yaml file. And it's taking without quotes – Synaesthesia

Can you once try with this- FilterPattern: '"error-res-received "' – Chloramine

There is also another way to escape the quotes in YAML: FilterPattern: >- "error-res-received " – Chloramine

Nope, it's still creating filter pattern as error-res-received – Synaesthesia