With AWS CloudWatch Logs, i'd like apply a filter, separating the fields in a message generated by a ruby logger.
I, [26/Oct/2015:04:35:12 +0000#11] INFO -- : (0.000934s) BEGIN
This is how the format is specified according to the Ruby docs:
SeverityID, [DateTime #pid] SeverityLabel -- ProgName: message
How do i extract the labels using a CloudWatch filter? Namely, how can i extract values between certain characters like the pID and parts of the actual message?
the short answer is that you cannot do that.
If logging in json format is an option you could potentially do something around extracting fields/values.
Docs are here: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/FilterAndPatternSyntax.html