AWS CloudFormation
User Guide (API Version 2010-05-15)


The AWS::Logs::MetricFilter resource creates a metric filter that describes how Amazon CloudWatch Logs extracts information from logs that you specify and transforms it into Amazon CloudWatch metrics. If you have multiple metric filters that are associated with a log group, all the filters are applied to the log streams in that group.


To declare this entity in your AWS CloudFormation template, use the following syntax:


{ "Type": "AWS::Logs::MetricFilter",     "Properties": { "FilterPattern": String, "LogGroupName": String, "MetricTransformations": [ MetricTransformations, ... ] } }


Type: AWS::Logs::MetricFilter Properties: FilterPattern: String LogGroupName: String MetricTransformations: MetricTransformations



For more information about constraints and values for each property, see PutMetricFilter in the Amazon CloudWatch Logs API Reference.


Describes the pattern that CloudWatch Logs follows to interpret each entry in a log. A log entry might contain fields such as timestamps, IP addresses, error codes, bytes transferred, and so on. You use the pattern to specify those fields and to specify what to look for in the log file. For example, if you're interested in error codes that begin with 1234, your filter pattern might be [timestamps, ip_addresses, error_codes = 1234*, size, ...]. For more information, see Filter and Pattern Syntax in the Amazon CloudWatch User Guide.

Required: Yes

Type: String

Update requires: No interruption


The name of an existing log group that you want to associate with this metric filter.

Required: Yes

Type: String

Update requires: Replacement


Describes how to transform data from a log into a CloudWatch metric.

Required: Yes

Type: A list of CloudWatch Logs MetricFilter MetricTransformation Property


Currently, you can specify only one metric transformation for each metric filter. If you want to specify multiple metric transformations, you must specify multiple metric filters.

Update requires: No interruption


The following example sends a value of 1 to the 404Count metric whenever the status code field includes a 404 value.


"404MetricFilter": { "Type": "AWS::Logs::MetricFilter", "Properties": { "LogGroupName": { "Ref": "myLogGroup" }, "FilterPattern": "[ip, identity, user_id, timestamp, request, status_code = 404, size]", "MetricTransformations": [ { "MetricValue": "1", "MetricNamespace": "WebServer/404s", "MetricName": "404Count" } ] } }


404MetricFilter: Type: AWS::Logs::MetricFilter Properties: LogGroupName: Ref: "myLogGroup" FilterPattern: "[ip, identity, user_id, timestamp, request, status_code = 404, size]" MetricTransformations: - MetricValue: "1" MetricNamespace: "WebServer/404s" MetricName: "404Count"

Additional Information

For an additional sample template, see Amazon CloudWatch Logs Template Snippets.