Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

filter for cloudwatch events

Saurabh Shah
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
August 14, 2023

Hi There

can I filter an alarm state OK value, we want to close an alert based on alarm status.

here is what we have tried:

using "detail" and regex combination - filter does not work.

using "detailMap" requires string either a key or value which doesn't work since it's nested JSON


here is an example event


    "version": "0",
    "id": "xx",
    "detail-type": "CloudWatch Alarm State Change",
    "source": "aws.cloudwatch",
    "account": "xx",
    "time": "2023-07-24T07:20:41Z",
    "region": "eu-west-2",
    "resources": [
    "detail": {
        "alarmName": "xx-nonprod-Test-Alarm",
        "state": {
            "value": "ALARM",
            "reason": "Threshold Crossed: 1 out of the last 1 datapoints [0.5 (24/07/23 07:15:00)] was greater than the threshold (0.1) (minimum 1 datapoint for OK -> ALARM transition).",
            "timestamp": "2023-07-24T07:20:41.222+0000"
        "previousState": {
            "value": "INSUFFICIENT_DATA",
            "reason": "Insufficient Data: 1 datapoint was unknown.",
            "timestamp": "2023-07-24T07:07:41.220+0000"
        "configuration": {
            "metrics": [
                    "id": "xx-5dbe-8bd2-03eb-xx",
                    "metricStat": {
                        "metric": {
                            "namespace": "AWS/ApiGateway",
                            "name": "4xx",
                            "dimensions": {
                                "ApiId": "xx"
                        "period": 300,
                        "stat": "Average"
                    "returnData": true
            "description": "Monitors the 4xx errors threshold"
PS: we are using CloudWatch event and not CloudWatch alarms Integration to avoid some duplication

1 answer

0 votes
John M
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
August 14, 2023

Hi @Saurabh Shah ,

If your alarm is not closing using the filter you've setup, you should be able to see why in the debug logs

One common reason is that the payload is matching the filter for the 'create' action, and thus deduplicates (increases the count of an open alert with the same alias) and never reaches the 'close' action (since actions are processed from top to bottom, and can only match one action, per payload).

If you don't see the issue, please post a screenshot of your both your 'create' and 'close' actions - including both the filters and the alert body configuration. 

Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events