Aws cloudwatch contributor insights filtering wildcards

516 Views Asked by At

Filtering logs in cloudwatch contributor insights StartsWith filter should support wildcards(as UI suggests), Star wildcard like *usergroup did not work. And when I have special characters like slash and colon it filters out everything.

Example of filter syntax that i use when i want to filter for value containg semicolons and slashes:

{
    "AggregateOn": "Count",
    "Contribution": {
        "Filters": [
            {
                "Match": "$.userIdentity",
                "StartsWith": [
                    "abc:8923879:aa/usergroup"
                ]
            }
        }
}

Example of filter syntax that i use when i want to filter with wildcards:

{
    "AggregateOn": "Count",
    "Contribution": {
        "Filters": [
            {
                "Match": "$.userIdentity",
                "StartsWith": [
                    "*usergroup"
                ]
            }
        }
}

I was expecting to be able to use StartsWith filter *usergroup to be able to filter only logs that have user from this group. Also if the value contains characters like slash, colon i expect that it will work, or maybe i need some escaping.

How to use wildcards? How should i escape non alphanumeric values?

0

There are 0 best solutions below