Filtering AWS CloudWatch raw log events by multiple values / AWS CLI

Question

Given the following query on CloudWatch that extracts logs with messages including "entry 1456" (where 1456 is an ID) how should I extend this to take multiple IDs and what is the corresponding CLI command?

fields  @message
| filter @message like "entry 1456"
| limit 10

To clarify I'd like to filter with multiple IDs, for instance "like 1456|1257|879". But not sure of the format of regex in such case.

And I assume the corresponding CLI command will be sth like:

aws logs filter-log-events 
--log-group-name group_name
--app
--filter-pattern ........

Just want to make sure of the best way to formulate this.

Answer 1

The syntax would be:

fields  @message
| filter @message like /entry [1456|1257]/
| limit 10

You could also parse the logline first and extract the value, like this:

fields  @message
| parse @message /.*entry (?<id>\d+).*/
| filter id in [1257, 1456]
| limit 10

Now for the CLI, you would not use the filter-log-events, but the start-query and get-query-results.

Answer 2

Just for visibility and copy/paste ability the current correct syntax is :

fields @message
| filter @message like /entry (1457|1458)/
| limit 20