AWS CloudWatch Log Metric Filter with JSON key has character space

Question

When creating an AWS CloudWatch Log Metric Filter, how would you match terms in JSON Log Events where the key has a character space in the name?

For example, let's assume there's a log line with JSON element like the following...

{"Event":"SparkListenerLogStart","Spark Version":"2.4.0-SNAPSHOT"}

How would you reference the "Spark Version"? $."Spark Version", $.Spark Version, $.Spark\ Version, and $.[Spark Version] don't work.

I couldn't find the answer in the AWS Filter and Pattern Syntax documentation.

Answer 1

At the time of writing, this is not possible. AWS will probably fix that at some point, but for now the only workaround would be to use the non-JSON syntax and search for the exact string. The following filter:

"\"Spark Version\":\"2.4.0-SNAPSHOT\""

will match:

{"Event":"SparkListenerLogStart","Spark Version":"2.4.0-SNAPSHOT"}