Terraform配置CloudWatch指标过滤器维度失效问题求助

• 通过Terraform创建CloudWatch Metric Filter和Metric Alarm，配合SNS发送告警邮件
• 不添加维度时，手动或Terraform配置均可正常运行，能统计所有表的总错误数
• 为Metric Filter添加TableName = "$.TableName"维度后，Metric Filter完全无法生成数据，仿佛无法识别日志
• 核心需求：每个TableName触发错误日志时，发送独立的告警邮件，实现单表错误的区分告警

日志示例（用户提供） #

{"TableName": "user_table", "Level": "ERROR", "Message": "Failed to write data"}
{"TableName": "order_table", "Level": "ERROR", "Message": "Connection timeout"}

当前Terraform代码片段 #

resource "aws_cloudwatch_metric_filter" "error_filter" {
  name           = "api-error-filter"
  pattern        = "{ $.Level = \"ERROR\" }"
  log_group_name = "/aws/api-gateway/my-api"

  metric_transformation {
    name      = "APIErrorCount"
    namespace = "API/Errors"
    value     = "1"
    // 添加该维度后无数据
    dimensions = {
      TableName = "$.TableName"
    }
  }
}

resource "aws_cloudwatch_metric_alarm" "error_alarm" {
  alarm_name          = "api-error-alarm"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "1"
  metric_name         = "APIErrorCount"
  namespace           = "API/Errors"
  period              = "60"
  statistic           = "Sum"
  threshold           = "1"
  alarm_description   = "Alarm when API has errors"
  alarm_actions       = [aws_sns_topic.alarm_topic.arn]

  dimensions = {
    TableName = "$.TableName"
  }
}

1. 先解决Metric Filter维度无数据的核心问题 #

CloudWatch Metric Filter的维度变量$.TableName必须和日志中的JSON字段严格匹配，注意以下几点：

• 日志必须是合法的JSON格式，不能有语法错误（比如逗号遗漏、引号不配对）
• 字段名大小写完全一致：如果日志里是tablename小写，配置里写TableName就匹配不到
• 确保所有ERROR级日志都包含TableName字段，避免有缺失字段的日志导致匹配失败
• 优化过滤模式，明确要求TableName存在：把pattern改成{ $.Level = \"ERROR\" && $.TableName EXISTS }，避免无TableName的日志干扰

2. 修正Metric Alarm的维度配置 #

你当前Alarm里写TableName = "$.TableName"是错误的——CloudWatch Alarm的维度需要指定具体的表名，不能用变量。要实现单表独立告警，推荐以下实用方式：

方式：提前确定监控表名，用for_each批量创建Alarm

适合能提前枚举需要监控的表名的场景，Terraform配置示例：

// 定义需要监控的表名列表
variable "monitored_tables" {
  type    = list(string)
  default = ["user_table", "order_table", "product_table"]
}

// 正确配置的Metric Filter
resource "aws_cloudwatch_metric_filter" "api_error_filter" {
  name           = "api-error-by-table"
  log_group_name = "/aws/api-gateway/my-api"
  pattern        = "{ $.Level = \"ERROR\" && $.TableName EXISTS }"

  metric_transformation {
    name      = "ErrorCount"
    namespace = "API/TableErrors"
    value     = "1"
    dimensions = {
      TableName = "$.TableName"
    }
  }
}

// 为每个表单独创建Alarm
resource "aws_cloudwatch_metric_alarm" "table_error_alarm" {
  for_each            = toset(var.monitored_tables)
  alarm_name          = "api-error-alarm-${each.value}"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "ErrorCount"
  namespace           = "API/TableErrors"
  period              = 60
  statistic           = "Sum"
  threshold           = 1
  alarm_description   = "告警：${each.value} 表出现API错误"
  alarm_actions       = [aws_sns_topic.alarm_topic.arn]

  // 这里指定具体的表名作为维度值
  dimensions = {
    TableName = each.value
  }
}

3. 无需借助Lambda #

只要日志格式规范，且能按上述方式配置，完全不需要Lambda即可实现单表独立告警。

4. 排查技巧 #

• 在AWS控制台的CloudWatch Logs Metric Filter页面，用测试模式验证过滤规则：输入日志示例，检查是否能匹配并生成正确的维度
• 查看CloudWatch Metrics的API/TableErrors命名空间，确认是否有带TableName维度的指标数据
• 检查IAM权限：确保CloudWatch Logs服务角色有cloudwatch:PutMetricData权限（默认权限足够，自定义角色需额外确认）

内容的提问来源于stack exchange，提问作者Scottish Smile