cloudwatch metric filter with filter pattern in CloudFormation template

Question

My Cloudformation stack is failing due to invalid filterPattern. I'm using below template code for creating filter metric in AWS

{
    "Resources": {
        "404MetricFilter": {
            "Type": "AWS::Logs::MetricFilter",
            "Properties": {
                "LogGroupName": "/aws/lambda/api-authorizer",
                "FilterPattern": "['missing token:']",
                "MetricTransformations": [
                    {
                        "MetricValue": "1",
                        "MetricNamespace": "Lambda/401s",
                        "MetricName": "401Count"
                    }
                ]
            }
        }
    }
}

Lambda logs has test "missing token:" which I need to use in filterPattern. Please help me to resolve this issue. Below is example of lambda log:

2020-04-23T06:41:51.839Z    9486e26e-4c8a-49b8-af23-c41b902a46a4    INFO    2020-04-23T06:41:51.839 - sso:[ERROR]: source_ip="182.76.82.166" request_id="021ca9cb-5e55-4c49-98da-3d5bbd7a3236" event_description="Error occurred: missing token: ms-sso" event_severity="high" event_status="failure" event_type="read" service_name="data-lambda"

I went through the documents provided by AWS but it is not helping: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

Any help would be greatly appreciated! Thanks in advance!

Answer 1

I found below solution to resolve filterPattern issue:

    {
    "Resources": {
        "404MetricFilter": {
            "Type": "AWS::Logs::MetricFilter",
            "Properties": {
                "LogGroupName": "/aws/lambda/mstar-fp-api-qa-us-east-1-lambda-api-authorizer",
                "FilterPattern": "event_description=\"Error occurred: missing token:\"",
                "MetricTransformations": [
                    {
                        "MetricValue": "1",
                        "MetricNamespace": "Lambda/401s",
                        "MetricName": "401Count"
                    }
                ]
            }
        }
    }
}