regex in CloudWatch event pattern matching

Question

How can I match a CloudWatch event on a regex. I need to invoke only a particular SNS target on a specific job name. e.g, something like below where I want to do a regex match on TranscriptionJobName. Thanks.

{
  "source": [
    "aws.transcribe"
  ],
  "detail-type": [
    "Transcribe Job State Change"
  ],
  "detail": {
    "TranscriptionJobStatus": [
      "COMPLETED",
      "FAILED"
    ],
    "TranscriptionJobName": [
      "transcription-localhost-*"
    ]
  }
}

I'm trying to make something similar. Is there any progress on this? — Yaroslav Tkachenko, Apr 17 '19 at 13:44
@YaroslavTkachenko : I ended up creating separate rule for each target SNS topic. — user4848830, Apr 18 '19 at 14:09

score 3 · Answer 1 · answered Oct 29 '20 at 20:41

This is now possible with EventBridge and its ability to do prefix matching. This works for me. I have a Lambda function set up as a target, and the function is executed only upon a Transcribe job reaching COMPLETED status and having a job name starting with voicemail-.

{
  "source": [
    "aws.transcribe"
  ],
  "detail": {
    "TranscriptionJobName": [
      {
        "prefix": "voicemail-"
      }
    ],
    "TranscriptionJobStatus": [
      "COMPLETED"
    ]
  }
}

score 1 · Accepted Answer · answered Apr 18 '19 at 14:08

1

I ended up creating separate rule for each target SNS topic.

answered Apr 18 '19 at 14:08

user4848830

779
12
22

score 1 · Answer 3 · answered Apr 30 '19 at 17:35

I'm trying to solve this as well and it does not appear this is possible, given the following AWS documentation.

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEventsandEventPatterns.html

It is important to remember the following about event pattern matching:

For a pattern to match an event, the event must contain all the field names listed in the pattern. The field names must appear in the event with the same nesting structure.

Other fields of the event not mentioned in the pattern are ignored; effectively, there is a "": "" wildcard for fields not mentioned.

The matching is exact (character-by-character), without case-folding or any other string normalization.

The values being matched follow JSON rules: Strings enclosed in quotes, numbers, and the unquoted keywords true, false, and null.

Number matching is at the string representation level. For example, 300, 300.0, and 3.0e2 are not considered equal.

Bummer...

score 0 · Answer 4 · edited Jul 14 '22 at 14:44

0

I have figured this out by using Numeric matching expression in the event pattern for Guard Duty findings something like below;

    {
      "detail": {
        "severity": [{
          "numeric": [">", 0, "<=", 8.9]
        }]
      },
      "detail-type": [
        "GuardDuty Finding"
      ],
      "source": [
        "aws.guardduty"
      ]
    }

edited Jul 14 '22 at 14:44

Asaph

159,146
25
197
199

answered Mar 31 '22 at 13:18

Sagar Jadhav

385
1
5
15

regex in CloudWatch event pattern matching

4 Answers4

Linked