How to include double quote in CloudWatch Logs filter?

Question

Enclose exact phrases and terms that include non-alphanumeric characters in double quotation marks (""). https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

Then, how should I include a double quote itself in query?

Jordan · Accepted Answer · 2024-08-15 22:36:09Z

6

You could use \x22 and regex. e.g.:

%\x22500\x22%

would search for "500"

answered Aug 15, 2024 at 22:36

Jordan

711 silver badge2 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

aosho235 · Accepted Answer · 2022-08-28 19:32:44Z

2

Escape the double quote with backslash: \"

answered Aug 28, 2022 at 19:32

aosho235

3631 gold badge4 silver badges17 bronze badges

2 Comments

Peter Schorn Over a year ago

Doesn't work: Invalid character(s) in term '\'. The escape character itself is not supported.

RichardM Mar 24 at 18:55

This did work for me. e.g. filter @message like /\"something\"/

Juuba7 · Accepted Answer · 2024-09-13 05:13:01Z

We had this kind of JSON:

{"code":"INPUT_VALIDATION_FAILED","fieldErrors":[{"field":"data","code":"INVALID_FORMAT"}]}

I could parse it when I wrapped the sting in single quotes. Simple:

fields @timestamp, @message, @logStream, @log | filter @message like " Res: 400" | parse @message '{"code":"*",' as ERRORCODE | display ERRORCODE | sort @timestamp desc | limit 100

This read the json, and parsed the ERRORCODE (ie. the INPUT_VALIDATION_FAILED) from the json.

Collectives™ on Stack Overflow

How to include double quote in CloudWatch Logs filter?

3 Answers 3

Comments

2 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

Comments

Related