This Terraform Module creates one or moreCloudWatch Logs Metric Filters using log filter patterns. The module will also create a metric alarms configured to push notifications to an SNS topic when the log filter patterns are matched.
aws_cloudwatch_log_metric_filter - A metric filter applied to the passed CloudWatch Logs Group
aws_cloudwatch_metric_alarm - An optional alarm associated with the new metric
What are CloudWatch Logs Metric Filters?
CloudWatch Logs Metric Filters are a feature to search the streams of a CloudWatch Log group for a specified pattern. If the pattern matches, a CloudWatch Metric associated with the pattern is increased by the given value. This allows you to build graphs or to set alarms associated with the events in your logs.
For example, consider the following log entry from CloudTrail (slightly edited for clarity):
This CloudTrail event shows a console log in by the root user of the account. AWS advises against using the root account, but it isn't possible to prevent root access at the account level. Instead, you can set up a CloudWatch Logs Metric Filter to send an alert if the event is matched.
How do filter patterns work?
Filter patterns match values in log events. Patterns can match exact words, multiple terms, and can also parse JSON log events. For example, the following pattern would match the message above:
This module automatically creates metric alarms for each filter. Each metric alarm will send notifications of state changes to an SNS topic. A state change occurs when the filter pattern is matched and the alarm threshold is breached for the given period. The alarm will enter the Alarm state and send a notification to the SNS topic. When the state is recovered, the alarm will enter the OK state and send another notification to the SNS topic.
The alarm_treat_missing_data option bears further explanation. When a filter pattern matches, it increments the given metric by 1 for each match. If no events are matching, the metric will not report any data at all. The alarm_treat_missing_data should be configured with the default setting of notBreaching to remain in the OK state when the no data is present. Acceptable values include: missing, ignore, breaching and notBreaching.
SNS options
The module will create an SNS topic with the name passed in sns_topic_name unless sns_topic_already_exists is set, in which case the alarm will be configured to send notifications to the pre-existing SNS topic given in sns_topic_arn.
Note that the module does not create any subscriptions to the SNS topic.
Questions? Ask away.
We're here to talk about our services, answer any questions, give advice, or just to chat.
{"treedata":{"name":"root","toggled":true,"children":[{"name":".circleci","children":[{"name":"config.yml","path":".circleci/config.yml","sha":"b212b7b074b01ee7affa65cdee79e0df83fee0d2"},{"name":"post-upgrade-test-results.sh","path":".circleci/post-upgrade-test-results.sh","sha":"a4867e8fbdc334b7a90259568ee41ea577fbe764"},{"name":"set-upgrade-test-vars.sh","path":".circleci/set-upgrade-test-vars.sh","sha":"04ccab865d51c1169f7ae4648c38a3d98a9889ab"}]},{"name":".editorconfig","path":".editorconfig","sha":"92ad89fbaccc7ba421a0965c03d8d3c3758e1773"},{"name":".github","children":[{"name":"ISSUE_TEMPLATE","children":[{"name":"bug_report.md","path":".github/ISSUE_TEMPLATE/bug_report.md","sha":"d2e87e27c601e423865ed660ec697082470ca60f"},{"name":"feature_request.md","path":".github/ISSUE_TEMPLATE/feature_request.md","sha":"023a33099be2336476930c96e17ff1ba5dc55348"}]},{"name":"pull_request_template.md","path":".github/pull_request_template.md","sha":"6b100e40e323b5b07f40ed30616277c51c9f4b9e"}]},{"name":".gitignore","path":".gitignore","sha":"f269ad202cb96c5ed31e7d2bdd7b2f9b829f0687"},{"name":".patcher","children":[{"name":"config.yaml","path":".patcher/config.yaml","sha":"41f2c1b50457efb801ee21be158d31cd9ad25da9"},{"name":"patches","children":[{"name":"aws-provider-4.x","children":[{"name":"bump_provider_aws_3.75.0.sh","path":".patcher/patches/aws-provider-4.x/bump_provider_aws_3.75.0.sh","sha":"7a3efe13136cca239fed10ac79a8235db63b46c7"},{"name":"create_script_for_terraform_init_3.75.0.sh","path":".patcher/patches/aws-provider-4.x/create_script_for_terraform_init_3.75.0.sh","sha":"dd909c8af08322b305458cf9c0377033ccbffd46"},{"name":"patch.yaml","path":".patcher/patches/aws-provider-4.x/patch.yaml","sha":"36f64bf00ef374e8ae3e5e01c26929a58e323527"}]}]}]},{"name":".pre-commit-config.yaml","path":".pre-commit-config.yaml","sha":"23068872ca60d7f40ae10c05ea8e5915d04056dc"},{"name":"CODEOWNERS","path":"CODEOWNERS","sha":"5f0e275ee3a38d13d1304c36d5e8640221690376"},{"name":"LICENSE.txt","path":"LICENSE.txt","sha":"f4e3d9bd4717a044ed31ad847a300eee74371a78"},{"name":"README.md","path":"README.md","sha":"76b4c3a155b70511647affe68676437ea7487739"},{"name":"_docs","children":[{"name":"cloudwatch-icon.png","path":"_docs/cloudwatch-icon.png","sha":"47443df949488ef42c8460a3ff23d0acab695e59"}]},{"name":"examples","children":[{"name":"alb-alarms","children":[{"name":"README.md","path":"examples/alb-alarms/README.md","sha":"ef0db18677a4fa8d12f6c890d94b442bf30f132a"},{"name":"main.tf","path":"examples/alb-alarms/main.tf","sha":"f831d015848e01ccf9c36450918293348a6fb9c7"},{"name":"outputs.tf","path":"examples/alb-alarms/outputs.tf","sha":"6fa5c1b548602ee8912c973ad05e3aec40cd32b0"},{"name":"variables.tf","path":"examples/alb-alarms/variables.tf","sha":"6f9edf33c508701e9bae1d7c8304295952e482b7"}]},{"name":"alb-target-group-alarms","children":[{"name":"README.md","path":"examples/alb-target-group-alarms/README.md","sha":"e0b8d977ae330122cdaa876e28219f0f7d5364ad"},{"name":"main.tf","path":"examples/alb-target-group-alarms/main.tf","sha":"b89252737fe49d04872121be08c7b8669ab0eb83"},{"name":"outputs.tf","path":"examples/alb-target-group-alarms/outputs.tf","sha":"c43657ddd3a1c40eb354c5192c4ecd3ebb26cf47"},{"name":"variables.tf","path":"examples/alb-target-group-alarms/variables.tf","sha":"7410e57ed960de8fbfdfa64a841d3752966d5326"}]},{"name":"asg-alarms","children":[{"name":"README.md","path":"examples/asg-alarms/README.md","sha":"10eb8a798dbbb80db76c32bd9eb6488a8fe484ad"},{"name":"main.tf","path":"examples/asg-alarms/main.tf","sha":"f612d036ba64cb1196b09e8b4ef961b60cbb6bba"},{"name":"outputs.tf","path":"examples/asg-alarms/outputs.tf","sha":"8259844bf891d7dd7a2745df89804b356df84a59"},{"name":"variables.tf","path":"examples/asg-alarms/variables.tf","sha":"c57fd6487ae4fa0687e580536f6a9884d3acec82"}]},{"name":"cloudwatch-agent","children":[{"name":"README.md","path":"examples/cloudwatch-agent/README.md","sha":"a20e7e5dcfcb53fb7a093f78e8d27588bb1425d1"},{"name":"main.tf","path":"examples/cloudwatch-agent/main.tf","sha":"f776fe92fcb5d9644cc51ec230cd16f1fd52190b"},{"name":"outputs.tf","path":"examples/cloudwatch-agent/outputs.tf","sha":"665dd2b857c42bfb167e606d964de352de1a6ac4"},{"name":"packer","children":[{"name":"build.json","path":"examples/cloudwatch-agent/packer/build.json","sha":"acce7ecd5167bf99c31cde47931245a511353ac4"}]},{"name":"user-data","children":[{"name":"user-data.sh","path":"examples/cloudwatch-agent/user-data/user-data.sh","sha":"953387d2b3ec71cf966a817ef53e08280ddbef29"}]},{"name":"variables.tf","path":"examples/cloudwatch-agent/variables.tf","sha":"75a8150cb55f06b214d4ddc2e7be9aa75153be98"}]},{"name":"cloudwatch-dashboard","children":[{"name":"README.md","path":"examples/cloudwatch-dashboard/README.md","sha":"08f0a36f254b3c064e822d13d43d44e619dda84d"},{"name":"main.tf","path":"examples/cloudwatch-dashboard/main.tf","sha":"2f9d65698a46e505cd1429163b2aaa8da14c53fd"},{"name":"outputs.tf","path":"examples/cloudwatch-dashboard/outputs.tf","sha":"44bdb681166336894d50e51dc64cfead255cff4f"},{"name":"variables.tf","path":"examples/cloudwatch-dashboard/variables.tf","sha":"d2fb5fd788e607085e024180bd2a68bf0678d58d"}]},{"name":"cloudwatch-logs-metric-filters","children":[{"name":"README.md","path":"examples/cloudwatch-logs-metric-filters/README.md","sha":"ec357e4bb56ceafcd336fd0d78c0543337701f97"},{"name":"main.tf","path":"examples/cloudwatch-logs-metric-filters/main.tf","sha":"8d5ec534d95aa91733abf44a9b90362a49452b7a"},{"name":"outputs.tf","path":"examples/cloudwatch-logs-metric-filters/outputs.tf","sha":"28d515dc5364afbc215ccdffbb03e3f3cd66a0ba"},{"name":"variables.tf","path":"examples/cloudwatch-logs-metric-filters/variables.tf","sha":"7fc7831e61510621a36bc50ff576fad550df8722"}]},{"name":"cloudwatch-logs-to-slack","children":[{"name":"README.md","path":"examples/cloudwatch-logs-to-slack/README.md","sha":"cef1b6979208b83c9474813c124a95d9b309931f"},{"name":"main.tf","path":"examples/cloudwatch-logs-to-slack/main.tf","sha":"a3f1c42848c951ec2be765c1e1c47a3d8e13b018"},{"name":"variables.tf","path":"examples/cloudwatch-logs-to-slack/variables.tf","sha":"8299bbb782ed8ed06d6a016df4b8d173989944a0"}]},{"name":"cloudwatch-to-slack","children":[{"name":"README.md","path":"examples/cloudwatch-to-slack/README.md","sha":"4e806611c7e42b382147bad2a82e690351edf9b9"},{"name":"main.tf","path":"examples/cloudwatch-to-slack/main.tf","sha":"d15f826316150b60c33cf39e4233c5468eaa863a"},{"name":"outputs.tf","path":"examples/cloudwatch-to-slack/outputs.tf","sha":"974908882a0473bb4e3ea7c7659c8ae7314d5de3"},{"name":"variables.tf","path":"examples/cloudwatch-to-slack/variables.tf","sha":"ae99c8f18bde992c0cedda836f03a4a0607a55c4"}]},{"name":"ec2-alarms","children":[{"name":"README.md","path":"examples/ec2-alarms/README.md","sha":"6fccf85d741b897f9de06bcd6bc3776c2da2e0e1"},{"name":"main.tf","path":"examples/ec2-alarms/main.tf","sha":"00722aa6f9c5d4eb14aa0d0b933889015b886c8a"},{"name":"outputs.tf","path":"examples/ec2-alarms/outputs.tf","sha":"db64d3c79fc4c66c49f0a86fb1bac85eacc9418f"},{"name":"variables.tf","path":"examples/ec2-alarms/variables.tf","sha":"5d5c5907ba090ffaefd2707e343c633f9cb0db90"}]},{"name":"ecs-alarms","children":[{"name":"README.md","path":"examples/ecs-alarms/README.md","sha":"5b38adf68e2891fe2afe4b19e2d5da9a583860ad"},{"name":"main.tf","path":"examples/ecs-alarms/main.tf","sha":"1899e68bdf42d39f68623b4bfe20ff104813f5ad"},{"name":"outputs.tf","path":"examples/ecs-alarms/outputs.tf","sha":"8259844bf891d7dd7a2745df89804b356df84a59"},{"name":"user-data","children":[{"name":"user-data.sh","path":"examples/ecs-alarms/user-data/user-data.sh","sha":"af6a43c618ff5f89ae997b9906a18db2bc5611ab"}]},{"name":"variables.tf","path":"examples/ecs-alarms/variables.tf","sha":"59ef88f78fe01f8652d097abb7d7b6b7ddb3ecff"}]},{"name":"elasticache-alarms","children":[{"name":"README.md","path":"examples/elasticache-alarms/README.md","sha":"51d8bd9847f3ea95851ab911d140d67391532578"},{"name":"main.tf","path":"examples/elasticache-alarms/main.tf","sha":"8e9a9f6b8b84576ae9e476557f3125b8d1fdcefc"},{"name":"outputs.tf","path":"examples/elasticache-alarms/outputs.tf","sha":"e6095a5c0089e1236e7507fbe8a59faf44c5c219"},{"name":"variables.tf","path":"examples/elasticache-alarms/variables.tf","sha":"bfa00fd8c445df907a3b49b8ac3735ac549039d0"}]},{"name":"elasticsearch-alarms","children":[{"name":"README.md","path":"examples/elasticsearch-alarms/README.md","sha":"9c493035998825f55937b4afa92c746662aeb03a"},{"name":"main.tf","path":"examples/elasticsearch-alarms/main.tf","sha":"6504aa1c9a6c8002c8e9b4365825196d8a296396"},{"name":"outputs.tf","path":"examples/elasticsearch-alarms/outputs.tf","sha":"8259844bf891d7dd7a2745df89804b356df84a59"},{"name":"variables.tf","path":"examples/elasticsearch-alarms/variables.tf","sha":"7e021ff0df92bfb433e9b6ea0d13e2b66f965de5"}]},{"name":"elb-alarms","children":[{"name":"README.md","path":"examples/elb-alarms/README.md","sha":"b5e0a2c6a4868bbbee510d2c5a85da984fc48d3f"},{"name":"main.tf","path":"examples/elb-alarms/main.tf","sha":"377b7246c2b2416c50f348c419d291d60e2ac3b4"},{"name":"outputs.tf","path":"examples/elb-alarms/outputs.tf","sha":"b98ff4cfcc70054d0f87a65883fa17e305c8189c"},{"name":"variables.tf","path":"examples/elb-alarms/variables.tf","sha":"bd33dc9c7bb27fac2eebd0b0042e7434137c798d"}]},{"name":"lambda-alarms","children":[{"name":"README.md","path":"examples/lambda-alarms/README.md","sha":"23196e276e2ecaf8dd7489d310795173abbc15b6"},{"name":"main.tf","path":"examples/lambda-alarms/main.tf","sha":"141ad2708fc131f6cfba1ac6645a13374c03cb10"},{"name":"outputs.tf","path":"examples/lambda-alarms/outputs.tf","sha":"e4f232637f1955a8099f7ae6f2b5bd4b6c13c14e"},{"name":"python","children":[{"name":"Dockerfile","path":"examples/lambda-alarms/python/Dockerfile","sha":"e01798399fc9c72f54f05fd68f181bd1c0cf0f33"},{"name":"build.sh","path":"examples/lambda-alarms/python/build.sh","sha":"bf53f2bdde463e8bd2f1a4f93009ecb1c6c0c206"},{"name":"requirements.txt","path":"examples/lambda-alarms/python/requirements.txt","sha":"2c24336eb3167f69afa069e02a2e44f55162039d"},{"name":"src","children":[{"name":"__init.py__","path":"examples/lambda-alarms/python/src/__init.py__","sha":"1b58820b01935d58928ad905427bd838c5e80123"},{"name":"index.py","path":"examples/lambda-alarms/python/src/index.py","sha":"d0233c21dc7572caead57e7e60c8d75a13312ea0"},{"name":"test_harness.py","path":"examples/lambda-alarms/python/src/test_harness.py","sha":"73edf34edf789e6f57b0d8288cedb22ec9d37bc3"}]}]},{"name":"variables.tf","path":"examples/lambda-alarms/variables.tf","sha":"39aa228faafdbc00a4ffa7e799979d97f17d0ddc"}]},{"name":"load-balancer-access-logs","children":[{"name":"alb","children":[{"name":"README.md","path":"examples/load-balancer-access-logs/alb/README.md","sha":"2c0f6aad2545f7517229a1a99e6497d0f20c96bf"},{"name":"main.tf","path":"examples/load-balancer-access-logs/alb/main.tf","sha":"8f089a7f156eb194d9581f051ffa7c88232c5598"},{"name":"outputs.tf","path":"examples/load-balancer-access-logs/alb/outputs.tf","sha":"3d68d5999618b1ce3a7913397ac9aca618205322"},{"name":"variables.tf","path":"examples/load-balancer-access-logs/alb/variables.tf","sha":"15760ff76bcec102533ac1436614d75e57c2bac5"}]},{"name":"elb","children":[{"name":"README.md","path":"examples/load-balancer-access-logs/elb/README.md","sha":"b15a7d6937ef9e20f25b047ec2b9a5629d0d4322"},{"name":"main.tf","path":"examples/load-balancer-access-logs/elb/main.tf","sha":"35e91efe807976f1cb6a9f8b6d7885e634440483"},{"name":"outputs.tf","path":"examples/load-balancer-access-logs/elb/outputs.tf","sha":"aac64206ee3f7b0067f35112081d62566ce9522d"},{"name":"variables.tf","path":"examples/load-balancer-access-logs/elb/variables.tf","sha":"15760ff76bcec102533ac1436614d75e57c2bac5"}]},{"name":"nlb","children":[{"name":"README.md","path":"examples/load-balancer-access-logs/nlb/README.md","sha":"932adf02397b8855ed0243a0220e992562c960f8"},{"name":"main.tf","path":"examples/load-balancer-access-logs/nlb/main.tf","sha":"91a7265c0de5a311bc11b73cdc9836dda71b34ea"},{"name":"outputs.tf","path":"examples/load-balancer-access-logs/nlb/outputs.tf","sha":"f2b50bd9ccf6afdca03c2f691ef44f6a75dc0722"},{"name":"variables.tf","path":"examples/load-balancer-access-logs/nlb/variables.tf","sha":"15760ff76bcec102533ac1436614d75e57c2bac5"}]}]},{"name":"rds-alarms","children":[{"name":"README.md","path":"examples/rds-alarms/README.md","sha":"3c0398694c0209629e0f536fbe75d29cc2b67569"},{"name":"main.tf","path":"examples/rds-alarms/main.tf","sha":"c963cd3e13383069e6374e02168ed93ca10d2014"},{"name":"outputs.tf","path":"examples/rds-alarms/outputs.tf","sha":"8259844bf891d7dd7a2745df89804b356df84a59"},{"name":"variables.tf","path":"examples/rds-alarms/variables.tf","sha":"4cae919361eadf1554ba818c6080316d2290d120"}]},{"name":"route53-health-check-alarms","children":[{"name":"README.md","path":"examples/route53-health-check-alarms/README.md","sha":"dd915bcca7542e7bfb8662de8629a7510112e110"},{"name":"main.tf","path":"examples/route53-health-check-alarms/main.tf","sha":"bde0cbb6f0835e8c925fdd438020914ad1ed9d98"},{"name":"outputs.tf","path":"examples/route53-health-check-alarms/outputs.tf","sha":"cf9efb7e6f4803244ba30aa368a32665efc9a9a2"},{"name":"variables.tf","path":"examples/route53-health-check-alarms/variables.tf","sha":"c8de0aca1b1773e29e5177d7acd0dc97fc1c29c7"}]},{"name":"scheduled-job-alarms","children":[{"name":"README.md","path":"examples/scheduled-job-alarms/README.md","sha":"f4ac16ea2b53201bffedfb903f25f24d524958e9"},{"name":"main.tf","path":"examples/scheduled-job-alarms/main.tf","sha":"d2a61c38d7ca42da8eb1ee6d3049e6cbbf5c6a4c"},{"name":"outputs.tf","path":"examples/scheduled-job-alarms/outputs.tf","sha":"8259844bf891d7dd7a2745df89804b356df84a59"},{"name":"variables.tf","path":"examples/scheduled-job-alarms/variables.tf","sha":"1d06c7678f23c5cf624b172f96d4d0bc6277e85f"}]},{"name":"sqs-alarms","children":[{"name":"README.md","path":"examples/sqs-alarms/README.md","sha":"92b201f5ce892bd0bd24bace8ac35f7729a26a1a"},{"name":"main.tf","path":"examples/sqs-alarms/main.tf","sha":"6051f065c8777092173dc0e6c6130e4669b1c00f"},{"name":"outputs.tf","path":"examples/sqs-alarms/outputs.tf","sha":"8259844bf891d7dd7a2745df89804b356df84a59"},{"name":"variables.tf","path":"examples/sqs-alarms/variables.tf","sha":"32a3fece3af25aed02386cfc74e073b1704389a1"}]},{"name":"syslog","children":[{"name":"README.md","path":"examples/syslog/README.md","sha":"5fa2747b5fade6ab04d6438bb8e5105a75101a8e"},{"name":"syslog-example.json","path":"examples/syslog/syslog-example.json","sha":"6008873e00a41a3f18d6db84c572806b419a2ba4"}]}]},{"name":"modules","children":[{"name":"agents","children":[{"name":"cloudwatch-agent","children":[{"name":"README.adoc","path":"modules/agents/cloudwatch-agent/README.adoc","sha":"b0dfffccc159dd84f76116f44f9158888573abfa"},{"name":"core-concepts.md","path":"modules/agents/cloudwatch-agent/core-concepts.md","sha":"526a628a81bddcc345fbe87c47551e18e0fab60a"},{"name":"install-scripts","children":[{"name":"config.json","path":"modules/agents/cloudwatch-agent/install-scripts/config.json","sha":"ae58c3821cbae98a23b37d28afe698d18385b796"},{"name":"install-cloudwatch-agent.sh","path":"modules/agents/cloudwatch-agent/install-scripts/install-cloudwatch-agent.sh","sha":"529bb9e6effa0217f327e1a813c88ca7fb8e20a1"}]},{"name":"install.sh","path":"modules/agents/cloudwatch-agent/install.sh","sha":"36b4b752f1ffa8b6f856c74835faf9ca262167ca"},{"name":"user-data-scripts","children":[{"name":"configure-cloudwatch-agent.sh","path":"modules/agents/cloudwatch-agent/user-data-scripts/configure-cloudwatch-agent.sh","sha":"684b164c10fbc66e0701f24f7131c0d69384caa0"},{"name":"restart-cloudwatch-agent.sh","path":"modules/agents/cloudwatch-agent/user-data-scripts/restart-cloudwatch-agent.sh","sha":"60cdb0fb221adc4dee57236daf9fe9461b4304ef"}]}]}]},{"name":"alarms","children":[{"name":"README.md","path":"modules/alarms/README.md","sha":"6469aa38d6deea5fd9c41b46efe3fc7934c47c86"},{"name":"alb-alarms","children":[{"name":"README.md","path":"modules/alarms/alb-alarms/README.md","sha":"a114be66833c30adf5486ce1f8a9a2af5c301006"},{"name":"main.tf","path":"modules/alarms/alb-alarms/main.tf","sha":"336c5656b7e441d8852b59e63b142e7bb3a174a2"},{"name":"variables.tf","path":"modules/alarms/alb-alarms/variables.tf","sha":"b0d0fae21e9f2d344d4bdb46e4106b03d577b686"}]},{"name":"alb-target-group-alarms","children":[{"name":"README.md","path":"modules/alarms/alb-target-group-alarms/README.md","sha":"9f74b6be1ce9d7d9d00dafd80f26047f6d517963"},{"name":"main.tf","path":"modules/alarms/alb-target-group-alarms/main.tf","sha":"859608f1da18bc0cacf68601f3ef7c57081f9105"},{"name":"variables.tf","path":"modules/alarms/alb-target-group-alarms/variables.tf","sha":"d5fa424e50b4aa543fc9351a6be0cf7659ba7a9b"}]},{"name":"asg-cpu-alarms","children":[{"name":"README.md","path":"modules/alarms/asg-cpu-alarms/README.md","sha":"5d8930a69b56e7e68de60460bc9ac086d78c3fdb"},{"name":"main.tf","path":"modules/alarms/asg-cpu-alarms/main.tf","sha":"0f154f3c5f45f79bd36ce0149bd3f351790750f4"},{"name":"variables.tf","path":"modules/alarms/asg-cpu-alarms/variables.tf","sha":"ed01e8b9ec506a567f237a39f57c8d9e9a302f0c"}]},{"name":"asg-disk-alarms","children":[{"name":"README.MD","path":"modules/alarms/asg-disk-alarms/README.MD","sha":"a70e4bb2774d2f34ab304c594bbf5af1274f42fd"},{"name":"main.tf","path":"modules/alarms/asg-disk-alarms/main.tf","sha":"7b6a5802a30a1eb8a83bb9ac49567a4ae28d0dad"},{"name":"variables.tf","path":"modules/alarms/asg-disk-alarms/variables.tf","sha":"b0131894cb79008273cd6aabbcf8aeeb41caf89d"}]},{"name":"asg-memory-alarms","children":[{"name":"README.md","path":"modules/alarms/asg-memory-alarms/README.md","sha":"5cee9559d7c409187099138db7480322b18aef1a"},{"name":"main.tf","path":"modules/alarms/asg-memory-alarms/main.tf","sha":"387f06ff48c96183d140881635d2945602b7f2d4"},{"name":"variables.tf","path":"modules/alarms/asg-memory-alarms/variables.tf","sha":"9fee782e79e6d0f47021704f0fddd063659d1c55"}]},{"name":"ec2-cpu-alarms","children":[{"name":"README.md","path":"modules/alarms/ec2-cpu-alarms/README.md","sha":"f5a086f005bf67ac936a00cbabc892c91c06b4b8"},{"name":"main.tf","path":"modules/alarms/ec2-cpu-alarms/main.tf","sha":"1e094c67b3b5737a4ab51c60e6054a73196ab162"},{"name":"variables.tf","path":"modules/alarms/ec2-cpu-alarms/variables.tf","sha":"45bca003cb49a8e3db0985df228fa7f1beff63e4"}]},{"name":"ec2-disk-alarms","children":[{"name":"README.MD","path":"modules/alarms/ec2-disk-alarms/README.MD","sha":"d06565ca47c749fe7033994d1fcd5779be0930c8"},{"name":"main.tf","path":"modules/alarms/ec2-disk-alarms/main.tf","sha":"b770320147bb74644f96e7a771dcc359516fc893"},{"name":"variables.tf","path":"modules/alarms/ec2-disk-alarms/variables.tf","sha":"ba7fee2a024e6b906bae73c18a1a6e722ff3479c"}]},{"name":"ec2-memory-alarms","children":[{"name":"README.md","path":"modules/alarms/ec2-memory-alarms/README.md","sha":"7b33625f7536545b2b71d978df3ecaa3b17d358c"},{"name":"main.tf","path":"modules/alarms/ec2-memory-alarms/main.tf","sha":"45d72dca3d794f9e103f8049f1853161150fa1af"},{"name":"variables.tf","path":"modules/alarms/ec2-memory-alarms/variables.tf","sha":"72ed2f7756bc2e6bdc25bb22e9af5bb0860f8476"}]},{"name":"ecs-cluster-alarms","children":[{"name":"README.md","path":"modules/alarms/ecs-cluster-alarms/README.md","sha":"4bbc7f714a6ac55589d649eda6883e3002bc3746"},{"name":"main.tf","path":"modules/alarms/ecs-cluster-alarms/main.tf","sha":"f18907deebe0b6e06822e7cf745b5c4e1961498b"},{"name":"variables.tf","path":"modules/alarms/ecs-cluster-alarms/variables.tf","sha":"e2e8a5a85352ea226453d10611a78b68d1b1dd51"}]},{"name":"ecs-service-alarms","children":[{"name":"README.md","path":"modules/alarms/ecs-service-alarms/README.md","sha":"d54663b23f2deb5ff48fe4493eab3b6b98685bfb"},{"name":"main.tf","path":"modules/alarms/ecs-service-alarms/main.tf","sha":"d507a917032e51d34572759dca9c9bb15d6cbae0"},{"name":"variables.tf","path":"modules/alarms/ecs-service-alarms/variables.tf","sha":"a9e1faeadd8d92c26eb031e9a5e94f927b32224e"}]},{"name":"ecs-service-with-alb-alarms","children":[{"name":"README.md","path":"modules/alarms/ecs-service-with-alb-alarms/README.md","sha":"1d2afa7f20a194083108491c8342ab1f22038174"}]},{"name":"elasticache-memcached-alarms","children":[{"name":"README.md","path":"modules/alarms/elasticache-memcached-alarms/README.md","sha":"bd5fd399c37e09a450dcb8bf878f3b57eb6ea09e"},{"name":"main.tf","path":"modules/alarms/elasticache-memcached-alarms/main.tf","sha":"516dcfe51f2a3e0afcb228a05181bc86f2b7701a"},{"name":"variables.tf","path":"modules/alarms/elasticache-memcached-alarms/variables.tf","sha":"05f9de3ff77b363de3524f2cbed2c783361718ed"}]},{"name":"elasticache-redis-alarms","children":[{"name":"README.md","path":"modules/alarms/elasticache-redis-alarms/README.md","sha":"becd381d6b4441e61cacbdd0a55c32b3caec2c02"},{"name":"main.tf","path":"modules/alarms/elasticache-redis-alarms/main.tf","sha":"bf2d63fd596bda986a29b5fbe24c35456ddd7f0c"},{"name":"variables.tf","path":"modules/alarms/elasticache-redis-alarms/variables.tf","sha":"279190d68db6c81b0decc830159a78f3089f2782"}]},{"name":"elasticsearch-alarms","children":[{"name":"README.md","path":"modules/alarms/elasticsearch-alarms/README.md","sha":"0cdc80ff90c0bf44ae5d2feaed06f35fa71a49f4"},{"name":"main.tf","path":"modules/alarms/elasticsearch-alarms/main.tf","sha":"ee8f52225451d45819b307475d82fa986559fca2"},{"name":"variables.tf","path":"modules/alarms/elasticsearch-alarms/variables.tf","sha":"1a0906cf3c8e0d6f2900a2bce40b1e38244bfcae"}]},{"name":"elb-alarms","children":[{"name":"README.md","path":"modules/alarms/elb-alarms/README.md","sha":"71a5fed07bfae58b6ac4f8e61699ad774a040987"},{"name":"main.tf","path":"modules/alarms/elb-alarms/main.tf","sha":"4b6226ee1dc26ceedf13c0a8ec7d3638ff1e074e"},{"name":"variables.tf","path":"modules/alarms/elb-alarms/variables.tf","sha":"88da91056f86feaff2ff4f0ffd1afa7377884ee9"}]},{"name":"lambda-alarms","children":[{"name":"README.md","path":"modules/alarms/lambda-alarms/README.md","sha":"df42d0dbd3daf18ee1a6075628dc28a255fb095a"},{"name":"main.tf","path":"modules/alarms/lambda-alarms/main.tf","sha":"7f7df191b9091430ca407300d19c6db413a521dc"},{"name":"outputs.tf","path":"modules/alarms/lambda-alarms/outputs.tf","sha":"8fc87125e9b1bde80d2e002df29773084b5ce5a0"},{"name":"variables.tf","path":"modules/alarms/lambda-alarms/variables.tf","sha":"af90444af969cb91f656a856889837e5f2e5de3b"}]},{"name":"rds-alarms","children":[{"name":"README.md","path":"modules/alarms/rds-alarms/README.md","sha":"b9e3381e5ec91ab1bed5329b779ca1e3898fabce"},{"name":"main.tf","path":"modules/alarms/rds-alarms/main.tf","sha":"4a3afeb234047798d015a6ad944c0f19e3df0d97"},{"name":"variables.tf","path":"modules/alarms/rds-alarms/variables.tf","sha":"4cc595c845ea9b203c7483fcfcebf8ca88c073b0"}]},{"name":"route53-health-check-alarms","children":[{"name":"README.md","path":"modules/alarms/route53-health-check-alarms/README.md","sha":"2268b9b10edb85e52252d50e76f6181d43c97128"},{"name":"main.tf","path":"modules/alarms/route53-health-check-alarms/main.tf","sha":"fb176e1283529f150aca496de0a4d773324454b5"},{"name":"outputs.tf","path":"modules/alarms/route53-health-check-alarms/outputs.tf","sha":"0e530fe84a73624a7758d9d96744fbc5b54621bc"},{"name":"variables.tf","path":"modules/alarms/route53-health-check-alarms/variables.tf","sha":"c25bca953d461c52fe4ed9ab3d44704d8df6c2be"}]},{"name":"scheduled-job-alarm","children":[{"name":"README.md","path":"modules/alarms/scheduled-job-alarm/README.md","sha":"50fcff7ab810d192f41063b747d76e132eee8713"},{"name":"main.tf","path":"modules/alarms/scheduled-job-alarm/main.tf","sha":"b2d60de054288104d200ace88f729f1e51efe117"},{"name":"variables.tf","path":"modules/alarms/scheduled-job-alarm/variables.tf","sha":"f6003166d086554edcc6aca2f8c38aabeca281b4"}]},{"name":"sns-to-slack","children":[{"name":"README.md","path":"modules/alarms/sns-to-slack/README.md","sha":"10c3a965474a2f2ee48dbc781903c1660db1cfa4"},{"name":"lambda","children":[{"name":"alerts.py","path":"modules/alarms/sns-to-slack/lambda/alerts.py","sha":"877fe277879969752f8354b94dd3fb7407cd138c"},{"name":"test-data","children":[{"name":"ec2-high-cpu-utilization-alert.json","path":"modules/alarms/sns-to-slack/lambda/test-data/ec2-high-cpu-utilization-alert.json","sha":"4efc79f1f6d77f0f715b86c0b86e9d95fd89d4a8"},{"name":"ec2-high-cpu-utilization-ok.json","path":"modules/alarms/sns-to-slack/lambda/test-data/ec2-high-cpu-utilization-ok.json","sha":"007ed86f4f4e2f23c5bac8b121de044ddb9b1753"}]},{"name":"test.py","path":"modules/alarms/sns-to-slack/lambda/test.py","sha":"8f6ace7f368a6b81fbcd5d5588363f39c2673ab8"}]},{"name":"main.tf","path":"modules/alarms/sns-to-slack/main.tf","sha":"c074e39b547e51b6a9a6461e4fbbfbd99e32ba9a"},{"name":"variables.tf","path":"modules/alarms/sns-to-slack/variables.tf","sha":"c7588dfab534e2acd24f178502b0af47160f7692"}]},{"name":"sqs-alarms","children":[{"name":"README.md","path":"modules/alarms/sqs-alarms/README.md","sha":"076c1e0546accdd50fd0f7a07435b84cfb0c21da"},{"name":"main.tf","path":"modules/alarms/sqs-alarms/main.tf","sha":"125db11b6795ca73219be452cb5bd4eb897d0078"},{"name":"variables.tf","path":"modules/alarms/sqs-alarms/variables.tf","sha":"c211f543ad5bdaf442d9152620a0136a6a090d56"}]}]},{"name":"logs","children":[{"name":"README.md","path":"modules/logs/README.md","sha":"5a4e697af404e0a51645d68b1a872c60834e9f99"},{"name":"_deprecated","children":[{"name":"cloudwatch-log-aggregation-scripts","children":[{"name":"README.md","path":"modules/logs/_deprecated/cloudwatch-log-aggregation-scripts/README.md","sha":"41fce9dfddc6537ad2e950e3e05675aeb2352798"}]},{"name":"elb-access-logs","children":[{"name":"README.md","path":"modules/logs/_deprecated/elb-access-logs/README.md","sha":"3cb659a6a9a53f33a1ce0c59aa99d1cbcdb4e8df"}]}]},{"name":"cloudwatch-log-aggregation-iam-policy","children":[{"name":"README.md","path":"modules/logs/cloudwatch-log-aggregation-iam-policy/README.md","sha":"7c9b7c45e2590d25f2f56cc23222a3ba0db7ab67"},{"name":"main.tf","path":"modules/logs/cloudwatch-log-aggregation-iam-policy/main.tf","sha":"f94547706c70d3079d95f8b4754404f9f56be554"},{"name":"outputs.tf","path":"modules/logs/cloudwatch-log-aggregation-iam-policy/outputs.tf","sha":"bd206e7139b681664671a31b09bf30533bc9ad48"},{"name":"variables.tf","path":"modules/logs/cloudwatch-log-aggregation-iam-policy/variables.tf","sha":"250152e6bfeb02a16bed4151ffc7156636db1bd9"}]},{"name":"cloudwatch-logs-metric-filters","children":[{"name":"README.md","path":"modules/logs/cloudwatch-logs-metric-filters/README.md","sha":"d8281b100291617ce01ed98eb313ba851a15b14d","toggled":true},{"name":"main.tf","path":"modules/logs/cloudwatch-logs-metric-filters/main.tf","sha":"2c3f49ffa775be3d3dc362a487049c8ca62ba3d9"},{"name":"outputs.tf","path":"modules/logs/cloudwatch-logs-metric-filters/outputs.tf","sha":"dec3f496d05244a3728103e172be6a90476577c4"},{"name":"variables.tf","path":"modules/logs/cloudwatch-logs-metric-filters/variables.tf","sha":"8542eb138f8522cc819247140f651fd9c4d9266e"}],"toggled":true},{"name":"load-balancer-access-logs","children":[{"name":"README.md","path":"modules/logs/load-balancer-access-logs/README.md","sha":"6556919790743845bd789f6e49c679949b0f8981"},{"name":"_docs","children":[{"name":"Upgrade Guide.md","path":"modules/logs/load-balancer-access-logs/_docs/Upgrade Guide.md","sha":"c073730734b5e6359d6c9e547af6a4dc606f5575"}]},{"name":"main.tf","path":"modules/logs/load-balancer-access-logs/main.tf","sha":"8e61a42308e035906c6e0c3edd5b988e8fca29fd"},{"name":"outputs.tf","path":"modules/logs/load-balancer-access-logs/outputs.tf","sha":"5bd1a74b58776a97a84fda11c40e8ff917d47f04"},{"name":"variables.tf","path":"modules/logs/load-balancer-access-logs/variables.tf","sha":"5dfe677ffddba906d0f3c9cd88136b8a08d425a8"}]},{"name":"log-filter-to-slack","children":[{"name":"README.md","path":"modules/logs/log-filter-to-slack/README.md","sha":"2ec38db9a5070055e21f25df8df8cbc0352540e6"},{"name":"lambda","children":[{"name":"handler.py","path":"modules/logs/log-filter-to-slack/lambda/handler.py","sha":"9e153b54abc181121fe3cbbca91079e801aef9f4"}]},{"name":"main.tf","path":"modules/logs/log-filter-to-slack/main.tf","sha":"fbe07bb52324711454ad69f174abb239afaed34b"},{"name":"variables.tf","path":"modules/logs/log-filter-to-slack/variables.tf","sha":"e9542cff2fe8ca71a8851699909a329ac1dc2804"}]},{"name":"syslog","children":[{"name":"README.md","path":"modules/logs/syslog/README.md","sha":"e206cf910a893ea255dbbe76796f1ad872421608"},{"name":"install-scripts","children":[{"name":"configure-syslog","path":"modules/logs/syslog/install-scripts/configure-syslog","sha":"6a859413008473e8b2e302a9cd025a4279016420"},{"name":"logrotate-config-amazon-linux","path":"modules/logs/syslog/install-scripts/logrotate-config-amazon-linux","sha":"1c3fedb3f165c7fcc89ce951f2ec28805c7373dc"},{"name":"logrotate-config-redhat","path":"modules/logs/syslog/install-scripts/logrotate-config-redhat","sha":"6aaf5e4f496d3742afccb9366ae5a0788d8716d3"},{"name":"logrotate-config-ubuntu","path":"modules/logs/syslog/install-scripts/logrotate-config-ubuntu","sha":"ea4603d761a8566a682bd194b8b0701198b34d59"}]},{"name":"install.sh","path":"modules/logs/syslog/install.sh","sha":"5995cf33d1b93a1d3397758f2de383386b9de94e"}]}],"toggled":true},{"name":"metrics","children":[{"name":"README.md","path":"modules/metrics/README.md","sha":"b1ac52c86288a6876aaa4fe7a971dd9bf7fb17ff"},{"name":"_deprecated","children":[{"name":"cloudwatch-memory-disk-metrics-scripts","children":[{"name":"README.md","path":"modules/metrics/_deprecated/cloudwatch-memory-disk-metrics-scripts/README.md","sha":"07bbc782adef777491067ce1e083e4bebf87897f"}]}]},{"name":"cloudwatch-custom-metrics-iam-policy","children":[{"name":"README.md","path":"modules/metrics/cloudwatch-custom-metrics-iam-policy/README.md","sha":"604c4e6ffcd1fb1486680112eb0ff28c061f4baa"},{"name":"main.tf","path":"modules/metrics/cloudwatch-custom-metrics-iam-policy/main.tf","sha":"9fcd5863686f07b1e33c3a243d71ec1617b5d6d9"},{"name":"outputs.tf","path":"modules/metrics/cloudwatch-custom-metrics-iam-policy/outputs.tf","sha":"a4333e31573fa21ec9b638794ab0e83b8b5adcff"},{"name":"variables.tf","path":"modules/metrics/cloudwatch-custom-metrics-iam-policy/variables.tf","sha":"187d43c4156f9e630ce0ff4d5111ea1e9f934a9f"}]},{"name":"cloudwatch-dashboard-metric-widget","children":[{"name":"README.md","path":"modules/metrics/cloudwatch-dashboard-metric-widget/README.md","sha":"1e74fa76f69a158a8e001e3c1d1f92903cf2946d"},{"name":"main.tf","path":"modules/metrics/cloudwatch-dashboard-metric-widget/main.tf","sha":"2a230ac7719a74dd2752d0f5a6fe7be2619a7187"},{"name":"outputs.tf","path":"modules/metrics/cloudwatch-dashboard-metric-widget/outputs.tf","sha":"b051fe38ab1908024978d27db681c88a5cac53ed"},{"name":"variables.tf","path":"modules/metrics/cloudwatch-dashboard-metric-widget/variables.tf","sha":"89519c38ffad943ba4926a150f1983dae74a6747"}]},{"name":"cloudwatch-dashboard-text-widget","children":[{"name":"README.md","path":"modules/metrics/cloudwatch-dashboard-text-widget/README.md","sha":"cd180e72c4ac373898ff2c74d8e56744baa71367"},{"name":"main.tf","path":"modules/metrics/cloudwatch-dashboard-text-widget/main.tf","sha":"bcfbe118f7526d6656bc2dd7a9c4ceb84d1afd9a"},{"name":"outputs.tf","path":"modules/metrics/cloudwatch-dashboard-text-widget/outputs.tf","sha":"b051fe38ab1908024978d27db681c88a5cac53ed"},{"name":"variables.tf","path":"modules/metrics/cloudwatch-dashboard-text-widget/variables.tf","sha":"610e30a2d694634e7f4f343120e3fc0924ab1973"}]},{"name":"cloudwatch-dashboard","children":[{"name":"README.md","path":"modules/metrics/cloudwatch-dashboard/README.md","sha":"e3cde88d2636c386213f4fd0a19c9cd0e3b7b259"},{"name":"main.tf","path":"modules/metrics/cloudwatch-dashboard/main.tf","sha":"6254be4b058c570caa390fa9fefb6212ceaabd90"},{"name":"outputs.tf","path":"modules/metrics/cloudwatch-dashboard/outputs.tf","sha":"d99f4b61c9c195a40e12fc541a047d1b5ee3162d"},{"name":"variables.tf","path":"modules/metrics/cloudwatch-dashboard/variables.tf","sha":"fca792d317ef3a17c940106d8945fb2836fd76e9"}]}]}],"toggled":true},{"name":"setup.cfg","path":"setup.cfg","sha":"a15b7cbd1d9f0ef05f58f4943354ee1a4bb6fe48"},{"name":"terraform-cloud-enterprise-private-module-registry-placeholder.tf","path":"terraform-cloud-enterprise-private-module-registry-placeholder.tf","sha":"ae586c0fe830819580e1009d41a9074f16e65bed"},{"name":"test","children":[{"name":"README.md","path":"test/README.md","sha":"5eea521c2c951df0d0cd375b38d8af3af460a674"},{"name":"alarms","children":[{"name":"alb_alarms_test.go","path":"test/alarms/alb_alarms_test.go","sha":"7528bc151f8d33dda0e20386b17c31822ea9dcfb"},{"name":"asg_alarms_test.go","path":"test/alarms/asg_alarms_test.go","sha":"47f87d0aa8dc89d8e5f7c83e4158eef527f14e1e"},{"name":"ec2_alarms_test.go","path":"test/alarms/ec2_alarms_test.go","sha":"256887c8593a5239de1fadc81abe99bdcd037b71"},{"name":"ecs_alarms_test.go","path":"test/alarms/ecs_alarms_test.go","sha":"0cf87ab838da100c20e7b8244b1d5b794eb8ce11"},{"name":"elasticache_alarms_test.go","path":"test/alarms/elasticache_alarms_test.go","sha":"388c30fc9e2696f16390f7943724a058f9c45699"},{"name":"elasticsearch_alarms_test.go","path":"test/alarms/elasticsearch_alarms_test.go","sha":"515356535a333085ff90f58e6b0ffef4377b09ea"},{"name":"elb_alarms_test.go","path":"test/alarms/elb_alarms_test.go","sha":"e0b39a29e37cc63cb5bf3709df3e046a441c966e"},{"name":"lambda_alarms_test.go","path":"test/alarms/lambda_alarms_test.go","sha":"139e0dca95303f0082f1ed473dd8daaf56813958"},{"name":"rds_alarms_test.go","path":"test/alarms/rds_alarms_test.go","sha":"9360b484cb8fb580a1a4552d376c78bc59346e81"},{"name":"route53_health_check_alarms_test.go","path":"test/alarms/route53_health_check_alarms_test.go","sha":"1f29ce18ecf8bdae47925ede3076cec301009bc7"},{"name":"scheduled_job_alarms_test.go","path":"test/alarms/scheduled_job_alarms_test.go","sha":"2cdd2219c5f71b6b48ada11cd94c63f732278be1"},{"name":"sqs_alarms_test.go","path":"test/alarms/sqs_alarms_test.go","sha":"7e97159fc3d293d8ba3fda3fb49c33adba6b5ef3"}]},{"name":"cloudwatch","children":[{"name":"cloudwatch_agent_test.go","path":"test/cloudwatch/cloudwatch_agent_test.go","sha":"b0867f7d556e03d88819479ca220beca2fefc79d"},{"name":"cloudwatch_dashboard_test.go","path":"test/cloudwatch/cloudwatch_dashboard_test.go","sha":"55ec54928588da96ab44b5f443b0d6c26c425d24"},{"name":"cloudwatch_logs_metric_filters_test.go","path":"test/cloudwatch/cloudwatch_logs_metric_filters_test.go","sha":"b65e4103d166c13db2300781ec741cf1d17427fb"},{"name":"cloudwatch_to_slack_test.go","path":"test/cloudwatch/cloudwatch_to_slack_test.go","sha":"57021e06b37a928aed9cfd8e3a7c8ee23be92e35"}]},{"name":"common","children":[{"name":"test_helpers.go","path":"test/common/test_helpers.go","sha":"196127fd3b1201fb81c5e2d8954a1ec131fdc598"}]},{"name":"go.mod","path":"test/go.mod","sha":"45949eeb95ed5af7fb42dd2b9d2aba88715e3379"},{"name":"go.sum","path":"test/go.sum","sha":"12be1fcfa74db3b72b6ce53de730ce4361dd8360"},{"name":"logs","children":[{"name":"lb_access_logs_test.go","path":"test/logs/lb_access_logs_test.go","sha":"83331fdeb45a3ba961c08a3f7d79551e0476d267"},{"name":"syslog_test.go","path":"test/logs/syslog_test.go","sha":"738ea23ad76f3c6cc9dc44e49f9388a3e27098a3"}]},{"name":"upgrades","children":[{"name":"constants.go","path":"test/upgrades/constants.go","sha":"6f51b9512b0419cccf69f52ce449a28d9317e272"},{"name":"upgrade_module_ec2_alarms_test.go","path":"test/upgrades/upgrade_module_ec2_alarms_test.go","sha":"54de123c8fd75ddbe44656cbec82dbb8b9f3abed"}]},{"name":"validation","children":[{"name":"validate_all_modules_and_examples_test.go","path":"test/validation/validate_all_modules_and_examples_test.go","sha":"74c928d0cbc2914e5cd708277bd857cb2375b660"}]}]}]},"detailsContent":"<h1 class=\"preview__body--title\" id=\"aws-cloud-watch-logs-metric-filters-terraform-module\">AWS CloudWatch Logs Metric Filters Terraform Module</h1><div class=\"preview__body--border\"></div><p>This Terraform Module creates one or more<a href=\"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html\" class=\"preview__body--description--blue\" target=\"_blank\">CloudWatch Logs Metric Filters</a> using <a href=\"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html\" class=\"preview__body--description--blue\" target=\"_blank\">log filter patterns</a>. The module will also create a metric alarms configured to push notifications to an SNS topic when the log filter patterns are matched.</p>\n<h2 class=\"preview__body--subtitle\" id=\"quick-start\">Quick Start</h2>\n<p>See the <a href=\"/repos/v0.30.0/terraform-aws-monitoring/examples/cloudwatch-logs-metric-filters\" class=\"preview__body--description--blue\">CloudWatch Logs Filter example</a> in this repo for an example of how to use the module.</p>\n<h2 class=\"preview__body--subtitle\" id=\"resources-created\">Resources Created</h2>\n<ul>\n<li><code>aws_cloudwatch_log_metric_filter</code> - A metric filter applied to the passed CloudWatch Logs Group</li>\n<li><code>aws_cloudwatch_metric_alarm</code> - An optional alarm associated with the new metric</li>\n</ul>\n<h2 class=\"preview__body--subtitle\" id=\"what-are-cloud-watch-logs-metric-filters\">What are CloudWatch Logs Metric Filters?</h2>\n<p>CloudWatch Logs Metric Filters are a feature to search the streams of a CloudWatch Log group for a specified pattern. If the pattern matches, a CloudWatch Metric associated with the pattern is increased by the given value. This allows you to build graphs or to set alarms associated with the events in your logs.</p>\n<p>For example, consider the following log entry from CloudTrail (slightly edited for clarity):</p>\n<pre>{\n <span class=\"hljs-attr\">\"userIdentity\"</span>: {\n <span class=\"hljs-attr\">\"type\"</span>: <span class=\"hljs-string\">\"Root\"</span>,\n <span class=\"hljs-attr\">\"principalId\"</span>: <span class=\"hljs-string\">\"012345678901\"</span>,\n <span class=\"hljs-attr\">\"arn\"</span>: <span class=\"hljs-string\">\"arn:aws:iam::012345678901:root\"</span>,\n <span class=\"hljs-attr\">\"accountId\"</span>: <span class=\"hljs-string\">\"012345678901\"</span>,\n },\n <span class=\"hljs-attr\">\"eventTime\"</span>: <span class=\"hljs-string\">\"2019-09-18T21:04:21Z\"</span>,\n <span class=\"hljs-attr\">\"eventSource\"</span>: <span class=\"hljs-string\">\"signin.amazonaws.com\"</span>,\n <span class=\"hljs-attr\">\"eventName\"</span>: <span class=\"hljs-string\">\"ConsoleLogin\"</span>,\n <span class=\"hljs-attr\">\"awsRegion\"</span>: <span class=\"hljs-string\">\"us-east-1\"</span>,\n <span class=\"hljs-attr\">\"sourceIPAddress\"</span>: <span class=\"hljs-string\">\"10.0.0.1\"</span>,\n <span class=\"hljs-attr\">\"userAgent\"</span>: <span class=\"hljs-string\">\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0\"</span>,\n <span class=\"hljs-attr\">\"responseElements\"</span>: {\n <span class=\"hljs-attr\">\"ConsoleLogin\"</span>: <span class=\"hljs-string\">\"Success\"</span>\n },\n <span class=\"hljs-attr\">\"additionalEventData\"</span>: {\n <span class=\"hljs-attr\">\"MobileVersion\"</span>: <span class=\"hljs-string\">\"No\"</span>,\n <span class=\"hljs-attr\">\"MFAUsed\"</span>: <span class=\"hljs-string\">\"No\"</span>\n },\n <span class=\"hljs-attr\">\"eventType\"</span>: <span class=\"hljs-string\">\"AwsConsoleSignIn\"</span>,\n}\n</pre>\n<p>This CloudTrail event shows a console log in by the root user of the account. <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html\" class=\"preview__body--description--blue\" target=\"_blank\">AWS advises</a> against using the root account, but it isn't possible to prevent root access at the account level. Instead, you can set up a CloudWatch Logs Metric Filter to send an alert if the event is matched.</p>\n<h2 class=\"preview__body--subtitle\" id=\"how-do-filter-patterns-work\">How do filter patterns work?</h2>\n<p>Filter patterns match values in log events. Patterns can match exact words, multiple terms, and can also parse JSON log events. For example, the following pattern would match the message above:</p>\n<pre><code>{ $.userIdentity.type = \\"Root\\" && $.eventType = \\"AwsConsoleSignIn\\"\n</code></pre>\n<p>In this module, you could match the event with the following <code>metric_map</code> variable definition:</p>\n<pre><code>metric_map = {\n "RootUserConsoleSignIn" = {\n pattern = "{ $.userIdentity.type = \\"Root\\" && $.eventType = \\"AwsConsoleSignIn\\" }"\n description = "Root user signed in to the console"\n\n }\n}\n</code></pre>\n<p>Refer to the <a href=\"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html\" class=\"preview__body--description--blue\" target=\"_blank\">AWS CloudWatch Logs Filter and Pattern syntax documentation</a> for a complete guide.</p>\n<h2 class=\"preview__body--subtitle\" id=\"how-does-the-metric-alarm-work\">How does the metric alarm work?</h2>\n<p>This module automatically creates metric alarms for each filter. Each metric alarm will send notifications of state changes to an SNS topic. A state change occurs when the filter pattern is matched and the alarm threshold is breached for the given period. The alarm will enter the <strong>Alarm</strong> state and send a notification to the SNS topic. When the state is recovered, the alarm will enter the <strong>OK</strong> state and send another notification to the SNS topic.</p>\n<p>The <a href=\"https://www.terraform.io/docs/providers/aws/r/cloudwatch_metric_alarm.html#treat_missing_data\" class=\"preview__body--description--blue\" target=\"_blank\"><code>alarm_treat_missing_data</code> option</a> bears further explanation. When a filter pattern matches, it increments the given metric by 1 for each match. If no events are matching, the metric will not report any data at all. The <code>alarm_treat_missing_data</code> should be configured with the default setting of <code>notBreaching</code> to remain in the <strong>OK</strong> state when the no data is present. Acceptable values include: <code>missing</code>, <code>ignore</code>, <code>breaching</code> and <code>notBreaching</code>.</p>\n<h2 class=\"preview__body--subtitle\" id=\"sns-options\">SNS options</h2>\n<p>The module will create an SNS topic with the name passed in <code>sns_topic_name</code> unless <code>sns_topic_already_exists</code> is set, in which case the alarm will be configured to send notifications to the pre-existing SNS topic given in <code>sns_topic_arn</code>.</p>\n<p>Note that the module <strong>does not</strong> create any subscriptions to the SNS topic.</p>\n","repoName":"terraform-aws-monitoring","repoRef":"v0.36.9","serviceDescriptor":{"serviceName":"CloudWatch","serviceRepoName":"terraform-aws-monitoring","serviceRepoOrg":"gruntwork-io","cloudProviders":["aws"],"description":"Send all metrics to CloudWatch, including those not visible to the EC2 hypervisor. Create dashboards and alerts as code.","imageUrl":"cloudwatch.png","licenseType":"subscriber","technologies":["Terraform","Bash"],"compliance":[],"tags":[""]},"serviceCategoryName":"Monitoring & alerting","fileName":"README.md","filePath":"/modules/logs/cloudwatch-logs-metric-filters","title":"Repo Browser: CloudWatch","description":"Browse the repos in the Gruntwork Infrastructure as Code Library."}