Skip to main content
In this lesson we’ll create a CloudWatch Logs metric filter that converts matching log events into a custom CloudWatch metric. Metric filters examine incoming log events for a pattern you define and publish a data point to the configured metric whenever a log event matches. Prerequisites:
  • An AWS account with permission to view and modify CloudWatch Logs and CloudWatch Metrics.
  • A log group (we’ll create one in this demo).
  1. Open the CloudWatch console and navigate to Logs → Log groups in the left-hand navigation. If you already have log groups they will appear here; for this walkthrough we’ll create a new one.
  2. Create a new log group. Give it a name and set retention and other options as needed. In this demo we create LogGroup1, set retention to never expire, and leave the log class as Standard.
Screenshot of the AWS CloudWatch "Create log group" page showing form fields — the log group name is set to "LogGroup1", retention set to "Never expire" and log class "Standard." The browser AWS console header and navigation are visible across the top.
  1. Select the new log group (LogGroup1), open Actions, and choose Create metric filter.
A metric filter lets CloudWatch inspect each incoming log event for a pattern you specify. When an event matches, CloudWatch publishes a data point to the metric you configure.
  1. Define the filter pattern — the text or structured fields CloudWatch should look for in each log event. For a simple, unstructured example, look for log lines that include the term ERROR. Matching is case-sensitive unless you explicitly include alternate variants.
Example filter patterns (simple term or quoted phrase matches):
Table — Example simple filter patterns and behavior
  1. (Optional) Use Field Selection Criteria for structured logs (JSON, key/value). For this basic demo we skip structured field selection and rely on plain-text pattern matching.
  2. Test the filter pattern using Custom Log Data. Paste several sample log lines to verify which events match your pattern. Example sample events:
Click Test pattern — CloudWatch will report how many sample events matched and list the matching events.
A screenshot of the AWS CloudWatch console on the "Create metric filter" page showing test results: "Found 2 matches out of 4 events" and a table listing event 2 "ERROR Database connection failed" and event 4 "ERROR Application timeout."
In this example, 2 of the 4 events match (ERROR Database connection failed and ERROR Application timeout), confirming the filter behaves as expected.
  1. Configure the metric that CloudWatch will publish for each matching event. Typical settings:
  • Filter name: choose a descriptive name (e.g., error-count-filter).
  • Metric namespace: logical grouping for your custom metrics (e.g., DemoApplication).
  • Metric name: the measurement name (e.g., ErrorCount).
  • Metric value: the numeric value to publish when an event matches — commonly set to 1 to count occurrences.
When Metric value = 1, each matching log event publishes a data point with value 1 to the ErrorCount metric, allowing you to count occurrences over time. Table — Metric configuration examples
Screenshot of the AWS CloudWatch console on the "Create metric filter" page. It shows a Metric namespace set to "DemoApplication" and a Metric name "ErrorCount" with the "Create new" toggle enabled.
  1. Review your configuration and create the metric filter.
  2. After creation, verify the filter under the log group’s Metric Filters to confirm the associated metric namespace/name and metric value are displayed. The console lists configured metric filters and the metrics they publish.
A screenshot of the AWS CloudWatch console showing the LogGroup1 metric settings. It displays a metric named "DemoApplication / ErrorCount" with a metric value of 1.
After the filter is active, CloudWatch publishes metric data points whenever a matching log event arrives. You can then:
  • Graph the custom metric in CloudWatch Metrics.
  • Add the metric to dashboards.
  • Create CloudWatch Alarms to trigger notifications when thresholds are crossed.
When using simple term-based patterns, remember matching is case-sensitive. For counting occurrences, set Metric value = 1 so each matched event increments the metric by one.
References and further reading: That completes the basic setup for pushing custom metrics from CloudWatch Logs via a metric filter.

Watch Video

Practice Lab