0

In AWS Cloudwatch, I would like to extract a value from my log data. however the value is in the message field. Is there anyway I can grab the last space delimited value and log that?

i.e. my log stream:

{"timestamp": 145674445, "message": "Starting new HTTP connection (1): XXXX", "severity": "INFO", "module": "connectionpool", "stack": []}
{"timestamp": 145676445, "message": "Starting new HTTP connection (1): XXXX", "severity": "INFO", "module": "connectionpool", "stack": []}
{"timestamp": 145676445, "message": "deactivated campaign: XXXX05XXXX554aaXXXX9069d4XXXXe7, runtime: 2.63", "severity": "INFO", "module": "credentials", "stack": []}

for the last log, i would like to filter pattern on something like 

{($.message ="deactivated campaign:*, runtime: *")}

and I would like to be able to have the metric value I record be 2.63, or the last space delimited string.

I am using the GUI for this, and cannot figure out a way to do it. is it possible?

Any help in advance is greatly appreciated!

Nick
  • 175
  • 5
  • 13

1 Answers1

0

Look at http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/FilterAndPatternSyntax.html

Something like this (haven't tested it, but something along these lines): 

metricFilter: { $.message = "deactivated campaign:*" } metricValue: $.runtime
Mircea
  • 10,216
  • 2
  • 30
  • 46
  • That wouldn't work as _runtime_ is not a filed in the JSON input; it's a sub-field (for lack of a better word) of the _message_ field. – dexterous Nov 10 '16 at 19:54