AWS Cloud Watch: Metric Filter Value Extraction

Question

I have cloud-init.log logs being sent to CloudWatch and I want to create a metric filter to extract the reported time it takes Cloud Init to run.

A sample log entry looks like:

Jun 24 12:06:51 ip-x-x-x-x [CLOUDINIT] util.py[DEBUG]: cloud-init mode 'modules' took 295.097 seconds (294.83)

And the value I would like to extract is: 295.097

It seems pretty straight forward because took [number] seconds is unique to just this line. This guide on metric filter syntax seems to only show examples for extracting values from JSON logs and this official example list doesn't cover it.

Based on the documentation, I figured something like:

[..., "took", seconds]

would work, but I haven't had much luck.

Any help would be really appreciated!

Answer 1

What you tried is almost correct, slight syntax change.

Instead of

[..., "took", seconds]

It should be

[..., took="took", seconds, secondsword, secondsparentheses]

The last two words don't matter what they are, I tried to pick useful names to say what they'd represent.

With this, seconds variable will now contain 295.097 which you can use in your metric.

The ... can be used at the beginning or at the end, but not both it seems, which is why we have to call out the secondsword and secondsparentheses afterwards.