# Cloudwatch log subscription filter escaping quotations issue

**URL:** <https://discuss.hashicorp.com/t/cloudwatch-log-subscription-filter-escaping-quotations-issue/40423>\
**Category:** AWS\
**Created:** [June 6, 2022, 9:50am UTC](https://discuss.hashicorp.com/t/cloudwatch-log-subscription-filter-escaping-quotations-issue/40423 "2022-06-06T09:50:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![giulianozor](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/giulianozor/32/28584_2.png) [@giulianozor](https://discuss.hashicorp.com/u/giulianozor)\
**Post date:** [June 6, 2022, 9:50am UTC](https://discuss.hashicorp.com/t/cloudwatch-log-subscription-filter-escaping-quotations-issue/40423/1 "2022-06-06T09:50:32Z")

</div>

Hello  
I am on terraform 1.2.2/aws provider 4.2.0

I need to create a pattern for a cloudwatch log subscription that matches

```auto
"level":"error"

```

Matching only error is not ok, because there is an “error\_id” in every message.  
I tried ““level”:“error”” (also "\“level”…) but I keep getting the error:

```auto
 Error: error updating CloudWatch Log Subscription Filter (XXX): InvalidParameterException: Invalid subscription filter pattern
│
│ with aws_cloudwatch_log_subscription_filter.logfilter[0],
│ on logs.tf line 9, in resource "aws_cloudwatch_log_subscription_filter" "logfilter":
│ 9: resource "aws_cloudwatch_log_subscription_filter" "logfilter" {
│
╵
ERRO[0016] 1 error occurred:
	* exit status 1

```

After some research I have tried to use format(), but it is not allowed in the variable definition…

sample

```auto
variable "lambda_streamer_filters" {
  default = "?\"level\":\"error\" ?Starting ?Shutting"
}

resource "aws_cloudwatch_log_subscription_filter" "logfilter" {
  name = "test-log-filter"
  log_group_name = "test"
  filter_pattern = var.lambda_streamer_filters
  destination_arn = replace(data.aws_lambda_function.lambda.arn, ":$LATEST", "")
  distribution = "ByLogStream"
}

```

Is there a way to have such pattern ? alternative is filter at the lambda function or add an extra key:val i can filter on and is not used anywhere else…

thank

---

<div class="post-metadata">

**Author:** ![\_andrew](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/_andrew/32/32572_2.png) [@\_andrew](https://discuss.hashicorp.com/u/_andrew)\
**Post date:** [December 14, 2022, 2:15am UTC](https://discuss.hashicorp.com/t/cloudwatch-log-subscription-filter-escaping-quotations-issue/40423/2 "2022-12-14T02:15:26Z")

</div>

the filter pattern in AWS is quite restrictive. it does support and interpret JSON, so to filter on ‘error’ level logs you can just do:

`{ $.level = "error" }`