client-cloudwatch-logs doesn't return some logs

[mike-bridgefy]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

When using the node library, data stored in cloudwatch is obtained, however it does not return the required information
package.json
... "dependencies": { "@aws-sdk/client-cloudwatch-logs": "^3.716.0", ...
We use log levels and when we try to return the logs of type "ERROR" the script returns an empty array, however if I do the same with type "INFO" it does return the information
Script

    const logs = await this._clientLogs.send(
      new FilterLogEventsCommand({
        logGroupName,
        logStreamNames,
        // filterPattern,
        filterPattern: '{$.logLevel="E*"}',
        startTime,
        endTime,
      }),
    );

If the same filter is performed in the AWS cloudwatch console, the information is returned correctly

fields @timestamp, @message, @logStream as username
| filter logLevel="ERROR"
| sort @timestamp desc
| limit 10000

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/[email protected]

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

20.12.1

Reproduction Steps

Try to make similar filters using the library and you will see that it does not return complete information

Observed Behavior

Using the package returns different information than in the AWS console when it should be the same

Expected Behavior

We expect the same behavior by doing the filters in the library and in the AWS console

Possible Solution

No response

Additional Information/Context

No response

[aBurmeseDev]

Hi @mike-bridgefy - thanks for reaching out.

Before we further investigate, could you try these expressions below?

// This filter pattern uses the JSON notation to specify the field name logLevel and checks if its value is exactly equal to the string "ERROR". 
filterPattern: '{ $.logLevel = "ERROR" }'

// This checks if the logLevel field starts with the letter "E" and is followed by any other characters. This pattern will match log events with log levels like "ERROR", "EMERGENCY", "EWARN", etc.
filterPattern: "?logLevel = /E.*/"

// This checks if the logLevel field exactly matches the string "ERROR". This pattern will only match log events with the log level "ERROR" and will not match log levels like "ERRORWARN" or "EMERROR".
filterPattern: "?logLevel = /ERROR/"