Skip to main content

Filtering Events in CloudWatch

Introduction​

This document provides guidance on how CloudWatch users can filter emitted events using CloudWatch Log Insights. The NestJS API emits and listens to specific events, and this guide will help you perform the necessary operations to locate specific CloudWatch logs.

Common Fields for All Events​

All events will have the following common fields available as output:

  • requestId: The API request ID
  • dateTime: The Date Time of request
  • userId: The MongoUserId of the user who made the request
  • keycloakUserId: The KeycloakUserId of the user who made the request
  • userEmail: The email of the user who made the request
  • eventType: The event type code
  • eventMetadata?: The specific event metadata

CloudWatch Log Insights Query​

Use the following query to filter logs based on your event type from all available events as detailed in Captured Events

fields @timestamp, @message 
| filter log_processed.metadata.eventType = "Admin:RoleAssignment"
| sort @timestamp desc 
| limit 50

Log Group​

Replace the event type in the query above and use the appropriate application Log Group:

/aws/containerinsights/dfl-uat-default-eks/application

Example: Admin Event - Role Assignment​

The following images illustrate the process of executing a log query in CloudWatch Log Insights and interpreting the results:

  1. Log Query Interface: The first image below shows the interface where you can input your query to filter specific events.

    Log Query

  2. Query Results: The second image displays the results of the query, highlighting the filtered logs based on the specified criteria.

    Log Query Result

    Below is a sample JSON representation of an emitted event:

    {
       "level": "info",
       "message": "Received Event Admin role assignment event",
       "metadata": {
          "component": "api",
          "dateTime": "2025-04-11T14:20:47.935Z",
          "eventMetadata": {
             "roles": [
             "org:dynamoguard:admin"
             ],
             "userEmail": "[email protected]",
             "userId": "66bd1456196dc139e00d2949"
          },
          "eventType": "Admin:RoleAssignment",
          "keycloakUserId": "1207a12c-5318-4410-9052-1ed2990603ad",
          "reqId": "298d5920-16e0-11f0-8c59-af8c20987092",
          "requestId": "298d5920-16e0-11f0-8c59-af8c20987092",
          "userEmail": "[email protected]",
          "userId": "66bd1456196dc139e00d2949"
       },
       "timestamp": "11-14:20:47.936"
    }