Matching array entries in AWS Cloudwatch log metrics filter
<p>I have JSON strings upload to AWS Cloudwatch logs and am now trying to write a filter that generates metrics from those logs.</p>
<p>Suppose I have JSON like the following:</p>
<pre><code>{&quot;test_results&quot;: [{&quot;result&quot;: &quot;success&quot;, &quot;name&quot;: &quot;foo&quot;, &quot;nr_failed&quot;: 0}, {&quot;result&quot;: &quot;failure&quot;, &quot;name&quot;: &quot;bar&quot;, &quot;nr_failed&quot;: 3}]}
</code></pre>
<p>The AWS Cloudwatch log metrics filter allows me to specify a pattern like the following:</p>
<pre><code>{ $.test_results[0].result = &quot;failure&quot; }
</code></pre>
<p>The above means, &quot;match the entire line if the zeroth entry in the value of 'test_results' has a
value of 'failure' for its 'result' field&quot;. In this particular case, the zeroth entry had a result
of 'success', so it wouldn't match. But this next line would match:</p>
<pre><code>{ $.test_results[1].result = &quot;failure&quot; }
</code></pre>
<p>Now suppose I want to match the whole line if <em>any</em> of the entries had a value of 'failure'.
Basically, I want to do this:</p>
<pre><code>{ $.test_results[*].result = &quot;failure&quot; }
</code></pre>
<p>But the pattern syntax doesn't seem to allow wildcards in the array index.
How can I match lines where any of the result values are &quot;failure&quot; ?</p>
<p>Alternatively, how could I pick out the numeric values for all the &quot;nr_failed&quot; fields in the &quot;test_results&quot; array and create metrics from those?</p>