AWS Cloudwatch: Searching for errors-CodePudding

I am trying to search for errors in AWS cloudwatch. The filter pattern I was using was:

?ERROR ?Exception

It was working fine, until, I encoutered a lot of WARN messages containing Exception keyword. Now, I would like to see Exception keyword where WARN is not there:

?ERROR ?Exception - WARN

But this is giving me back every log message. Can there be a way to have such search criteria?

CodePudding user response：

I don't know, if you can do with a Cloud Watch filter (probably not), but you can do it in Logs Insights:

fields @timestamp, @message
| filter @message like /ERROR/
| filter @message like /Exception/
| filter @message not like /WARN/
| sort @timestamp desc
| limit 200

CodePudding user response：

You can use the following syntax:

[(w1="*ERROR*" || w1="*Exception*") && w1!="*WARN*"]

which means: match either ERROR or Exception and make sure not to match WARN