Filtering logs in cloudwatch contributor insights StartsWith filter should support wildcards(as UI suggests), Star wildcard like *usergroup did not work. And when I have special characters like slash and colon it filters out everything.
Example of filter syntax that i use when i want to filter for value containg semicolons and slashes:
{
"AggregateOn": "Count",
"Contribution": {
"Filters": [
{
"Match": "$.userIdentity",
"StartsWith": [
"abc:8923879:aa/usergroup"
]
}
}
}
Example of filter syntax that i use when i want to filter with wildcards:
{
"AggregateOn": "Count",
"Contribution": {
"Filters": [
{
"Match": "$.userIdentity",
"StartsWith": [
"*usergroup"
]
}
}
}
I was expecting to be able to use StartsWith filter *usergroup to be able to filter only logs that have user from this group. Also if the value contains characters like slash, colon i expect that it will work, or maybe i need some escaping.
How to use wildcards? How should i escape non alphanumeric values?