I'm trying to come up with a metric filter expression that filters CloudWatch Logs when a special JSON key attribute is present.

Use case is the following: the application does all kinds of logging(in JSON format) and whenever it has a special JSON key(nested JSON response from third-part service), I would like to filter it.

Example logs:

```jsonl
{"severity":"INFO","msg":"EVENT","event":{"key1":"value1"}}
{"severity":"INFO","msg":"FooService responded","response":{"response_code":800}}

```

Filter patterns that I've tried that don't work:

```none
{ $.response }
{ $.response = *}
{ $.response = "*"}
{ $.response EXISTS }
{ $.response IS TRUE }
{ $.response NOT NULL }
{ $.response != NULL }

```

Expected filtering result:

```jsonl
{"severity":"INFO","msg":"FooService responded","response":{"response_code":800}}

```

---

`{ $.response EXISTS }` does the opposite of what I expect(returns the 1st line rather than then 2nd) but I'm not sure how to negate it.

Reference material: [Filter and pattern syntax @ CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html)