I am trying to search for errors in AWS cloudwatch. The filter pattern I was using was:
?ERROR ?Exception
It was working fine, until, I encoutered a lot of WARN messages containing Exception keyword. Now, I would like to see Exception keyword where WARN is not there:
?ERROR ?Exception - WARN
But this is giving me back every log message. Can there be a way to have such search criteria?
I don't know, if you can do with a Cloud Watch filter (probably not), but you can do it in Logs Insights:
fields @timestamp, @message
| filter @message like /ERROR/
| filter @message like /Exception/
| filter @message not like /WARN/
| sort @timestamp desc
| limit 200
You can use the following syntax:
[(w1="*ERROR*" || w1="*Exception*") && w1!="*WARN*"]
which means: match either ERROR or Exception and make sure not to match WARN