Question: LogMonitoring with addMaxIncomingLogsAlarm and a Pattern

[sndpl]

Hi,

since 22 march it's possible to add an addMaxIncomingLogsAlarm to the LogMonitoring (#504). But I was wondering, if you set a pattern like:

.monitorLog({
  logGroupName: ".....",
  pattern: "ERROR",
  addMaxIncomingLogsAlarm: {
	  Critical: {
		  maxCount: 5,
		  period: Duration.minutes(5),
		  treatMissingDataOverride: TreatMissingData.NOT_BREACHING,
		  actionOverride: new SnsAlarmActionStrategy({
			  onAlarmTopic: criticalTopic,
			  onOkTopic: criticalTopic,
		  }),
	  },
  },
});

It shows the log lines which contain the pattern (very nice), but it also shows the incoming logs on which it creates the alarm:

But those incoming logs are not filtered with the given pattern? Also the alarm is not using the pattern.

I would expect that it creates an alarm that count's the log lines with the pattern and if there are more then 5 in a period of 5 min it goes into the alarm state. So is it a bug or do I just not understand where this addMaxIncomingLogsAlarm feature is for? because It now just creates a sample count alarm that goes in alarm state if the lambda is called more then 5 times in 5 min.

[maltelorbach]

Possibly not even directly related to the alarm feature, because the Incoming logs widget doesn't filter using the pattern at all.

In my case (without alarm), no log lines match the pattern, but the visualization simply shows all incoming logs.

facade.monitor_log(
    log_group_name=log_group.log_group_name,
    human_readable_name=name,
    pattern=f'"level":"{level.upper()}"',
    alarm_friendly_name=name.lower(),
    limit=limit,
)

[joeydebreuk]

👋

I created the initial feature request here, I can confirm it doesn't work for me either. The alarm raises for any log statement, regardless of the pattern.

[maltelorbach]

Is there any progress on this? This seems like a bug to me.