How do you check for the existence of a field in an Cloudwatch JSON filter?

user_30946 0
Viewed 1229

This is a terraform setup:

resource "aws_cloudwatch_log_metric_filter" "account-query-time" {
  name           = "${local.name_prefix}-AccountQueryTime"
  pattern        = "{ $.message = \"AccountQuery_70fed564\"  }"
  log_group_name = yaddayadda

  metric_transformation {
    name      = "AccountQueryTime"
    namespace = "Accounts"
    value     = "$.time"
  }
}

Logs have JSON objects like {"message": "AccountQuery_70fed564", "time": 320, "units", "microseconds"}

Relevant portion is pattern = "{ $.message = \"AccountQuery_70fed564\" }". Can I make sure the field exists as part of the pattern? Will the filter only pick fields that are valid for its metric transform?

I'd like to make sure that this metric will not add in messages that are missing the time field. The docs have NOT EXISTS but don't have EXISTS by itself.

Tried:

  • && $.time
  • && $.time EXISTS
  • && !!$.time

Is it not necessary to check for the existence of a field? Seems safer to confirm that it is there before you go and add it to your metric...

amazon-cloudwatch terraform amazon-web-services json
3 Answers

Looks like this will do it:

"{ $.message = \"AccountQuery_70fed564\" && $.units = * && $.time = * }"

user_309460

If you want the inverse of the exists call, you need to both check if it has data and if it is null.

I haven't found a way to do this in one call, like the doesn't exist call from the Docs

{ $.SomeOtherObject NOT EXISTS }

However if you do both the following, it evaluates to being the invese of the above:

{ $.SomeOtherObject = * EXISTS || $.SomeOtherObject IS NULL }

That should get you all instances where SomeOtherObject exists in your context, be it null or set to a value

user_10016520

Not sure this works in your case but to filter on logs which has a field doing != "" usually works:

{$.some.field != "" }
user_12022140
Related