My cloudwatch logs are JSON formatted and filtering by different fields have been no issue until I tried to filter by a boolean field.
I have a boolean field called low_physical_memory (the line looks like this "low_physical_memory": false,) and I try to filter by it either being true or false but my filter returns nothing even though I can check the unfiltered log that I should get matches in both cases.
Variants that I've tried with no luck:
{$.msg.data.db_memory_usage.low_physical_memory=false}{$.msg.data.db_memory_usage.low_physical_memory=False}{$.msg.data.db_memory_usage.low_physical_memory=FALSE}{$.msg.data.db_memory_usage.low_physical_memory="false"}{$.msg.data.db_memory_usage.low_physical_memory=0}"\"low_physical_memory\": false"this one works but it's not a JSON filter and feels more like an ugly hack.
So to repeat the question from the title, how do I perform JSON filtering by boolean field in AWS CloudWatch?