Search AWS CloudWatch Logs with Special Character in JSON Property Name
We use AWS CloudWatch Logs to debug our services running on AWS and some of the property names in our logs use colons as separators, but we can't figure out how to search using those property names.
Here's an example log:
{
"Counts": {
"RouteHandler:GetCookies": {
"value": 1
}
}
}
Using the console, I tried a query like this:
{ $.Counts.RouteHandler:GetCookies.value = 1 }
Of course, special characters are often used in query languages and in other cases, so I am trying to avoid that somehow.
{ $.Counts.RouteHandler\:GetCookies.value = 1 }
// JavaScript inspired
{ $.Counts["RouteHandler:GetCookies"].value = 1 }
// Special character removed
{ $.Counts.RouteHandlerGetCookies.value = 1 }
Nothing I could think of worked, and it might just not be possible. The docs don't seem to address this type of script.
Does anyone know how to look in JSON logs where properties contain special characters, or know exactly if this is supported or not?
We'll be using a different separator in the new work, but we're not going to go back and change it everywhere.
source to share
At the time of this writing, this is not possible. AWS will probably fix this at some point, but for now the only workaround would be to use non-JSON syntax and search for the exact string. Next filter:
"\"RouteHandler:GetCookies\": {\"value\": 1}"
will match this log event:
{"Counts": {"RouteHandler:GetCookies": {"value": 1}}}
Obviously, the downside is that spaces and position matter.
source to share