AWS Cloudwatch Search Expression

Question

I want to see if the community could help me figure out if this is possible.

I'm currently working with a lot of data in Cloudwatch and after getting the search expression to work I was wondering if we could take something like:

[{"expression": 
    "SEARCH('{AWS/ApiGateway,ApiName} ApiName', 'Average', 300)", "id": "e2"}]

and use it to only return specific ApiName's.

Example being:

test1
test2
test3
data1
data2
data3
Fubar1

I ask this because with the line above it will show all those data in Cloudwatch and that's useful and great but I want to know if I can do something like.

[{"expression": 
    "SEARCH('{AWS/ApiGateway,ApiName} ApiName = \"test"\', 'Average', 300)", "id": "e2"}]

And have it return just:

test1
test2
test3

I'm reaching out because from documentation it seems like it's not possible and that if I want to do something like this I should maybe look into Log Filters potentially. Anyways thanks for any responses.

Answer 1

If you do ApiName="test" it will match exactly test, but if you remove the double quotes and do ApiName=test it will mach all ApiNames that contain test.

So your expression would be

[ { "expression": "SEARCH('{AWS/ApiGateway,ApiName} ApiName=test', 'Average', 300)", "id": "e2" } ]

See here for more examples: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/search-expression-examples.html