Can someone give me an example of a custom CloudWatch Event Pattern

Question

I am trying to write a custom CloudWatch Event Pattern that will trigger an SSM Run Command. The problem I am having is I am not sure how I am supposed to write this event pattern. I've looked at the documentation and I am just not understanding how to do this. The documentation gave an example such as:

{
 "source": [ "aws.ec2"]
}

which will watch for all events from the EC2 service, that I understand. But how would I watch for, say... a specific message in a CloudWatch Logs Log Group?

Answer 1

Answering the original question. Here's a sample.

{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["running"]
  }
}

you can find a lot more at patterns within https://docs.aws.amazon.com/eventbridge/latest/userguide/eventbridge-and-event-patterns.html. Definitely the Content-based Filtering with Event Patterns page like

{
  "time": [ { "prefix": "2017-10-02" } ],
  "detail": {
    "state": [ { "anything-but": "initializing" } ],
    "c-count": [ { "numeric": [ ">", 0, "<=", 5 ] } ],
    "d-count": [ { "numeric": [ "<", 10 ] } ],
    "x-limit": [ { "anything-but": [ 100, 200, 300 ] } ]
  }
}