regex in CloudWatch event pattern matching

Question

How can I match a CloudWatch event on a regex. I need to invoke only a particular SNS target on a specific job name. e.g, something like below where I want to do a regex match on TranscriptionJobName. Thanks.

{
  "source": [
    "aws.transcribe"
  ],
  "detail-type": [
    "Transcribe Job State Change"
  ],
  "detail": {
    "TranscriptionJobStatus": [
      "COMPLETED",
      "FAILED"
    ],
    "TranscriptionJobName": [
      "transcription-localhost-*"
    ]
  }
}

I'm trying to make something similar. Is there any progress on this? — Yaroslav Tkachenko
– Yaroslav Tkachenko, Commented Apr 17, 2019 at 13:44
@YaroslavTkachenko : I ended up creating separate rule for each target SNS topic. — user4848830
– user4848830, Commented Apr 18, 2019 at 14:09

ctc · Accepted Answer · 2020-10-29 20:41:09Z

3

This is now possible with EventBridge and its ability to do prefix matching. This works for me. I have a Lambda function set up as a target, and the function is executed only upon a Transcribe job reaching COMPLETED status and having a job name starting with voicemail-.

{
  "source": [
    "aws.transcribe"
  ],
  "detail": {
    "TranscriptionJobName": [
      {
        "prefix": "voicemail-"
      }
    ],
    "TranscriptionJobStatus": [
      "COMPLETED"
    ]
  }
}

answered Oct 29, 2020 at 20:41

ctc

2,8701 gold badge18 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ctc Over a year ago

Glad it was useful.

Brooks · Accepted Answer · 2019-04-30 17:35:05Z

I'm trying to solve this as well and it does not appear this is possible, given the following AWS documentation.

https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/CloudWatchEventsandEventPatterns.html

It is important to remember the following about event pattern matching:

For a pattern to match an event, the event must contain all the field names listed in the pattern. The field names must appear in the event with the same nesting structure.

Other fields of the event not mentioned in the pattern are ignored; effectively, there is a "": "" wildcard for fields not mentioned.

The matching is exact (character-by-character), without case-folding or any other string normalization.

The values being matched follow JSON rules: Strings enclosed in quotes, numbers, and the unquoted keywords true, false, and null.

Number matching is at the string representation level. For example, 300, 300.0, and 3.0e2 are not considered equal.

Bummer...

user4848830 · Accepted Answer · 2019-04-18 14:08:52Z

1

I ended up creating separate rule for each target SNS topic.

answered Apr 18, 2019 at 14:08

user4848830

82914 silver badges24 bronze badges

Comments

Asaph · Accepted Answer · 2022-07-14 14:44:46Z

0

I have figured this out by using Numeric matching expression in the event pattern for Guard Duty findings something like below;

    {
      "detail": {
        "severity": [{
          "numeric": [">", 0, "<=", 8.9]
        }]
      },
      "detail-type": [
        "GuardDuty Finding"
      ],
      "source": [
        "aws.guardduty"
      ]
    }

edited Jul 14, 2022 at 14:44

Asaph

163k25 gold badges204 silver badges204 bronze badges

answered Mar 31, 2022 at 13:18

Sagar Jadhav

5493 gold badges6 silver badges17 bronze badges

Collectives™ on Stack Overflow

regex in CloudWatch event pattern matching

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related