How to analyze mixed texts and JSON log entries in AWS CloudWatch for metric filter log

Question

I am trying to parse log entries that are a combination of text and JSON. The first line is a textual representation, and the next lines are useful JSON information for the event. One possible example:

2016-07-24T21:08:07.888Z [INFO] Command completed lessonrecords-create { "key": "lessonrecords-create", "correlationId": "c1c07081-3f67-4ab3-a5e2-1b3a16c87961", "result": { "id": "9457ce88-4e6f-4084-bbea-14fff78ce5b6", "status": "NA", "private": false, "note": "Test note", "time": "2016-02-01T01:24:00.000Z", "updatedAt": "2016-07-24T21:08:07.879Z", "createdAt": "2016-07-24T21:08:07.879Z", "authorId": null, "lessonId": null, "groupId": null } } 

For these entries, I am trying to define a Log Metric Filter: a) match entries; b) select data or dimensions, if possible.

According to AWS docs, the JSON template should look like this:

{ $.key = "lessonrecords-create" }

however, it does not match anything. I suppose due to mixed text and JSON in a single log entry.

So, the questions: 1. Is it possible to determine a template that will correspond to this format of the magazine? 2. Is it possible to extract sizes, values ​​from such a magazine format? 3. Help me with a template to do this.

Answer 1

If you configured the metrics filter in the way you defined it, the test will not register matches (I also had this problem), but when you deploy the metrics filter, it will still register matches (at least mine). Just keep in mind that there is no way (as far as I know) to run this BACKWARDS metric filter (that is, it will only capture data from the moment it is created). [If you are trying to get past statistics, you'd better use log comprehension queries]

I am currently experimenting with various parsing operators to try to extract data (its also a combination of JSON and text), this thread can help you (this is not for me) Amazon Cloudwatch Insights Logs with JSON fields .