So I have an instance setup and have cloudwatch logs to monitor /opt/test/testing and a metric filter setup to look for the phrase "hey" and a coudwatch alarm to trigger to send an email when this state is set to alarm and then once again when the status switches to OK.
So the alarm email part works (and so does the OK one) except once this is triggered, it will ALWAYS stay in an alart status. Which would suck if I need to monitor a specific log file and a specific pattern.
Is there something I can do to trigger it to be ok once acknowledged other than manually removing those entries?
I ended up figuring it out. I did not know that a log file that isn't active will change to an Insufficient status. –