title: AWS Cloud Watch: Metric Filter Value Extraction
body: <p>I have <code>cloud-init.log</code> logs being sent to CloudWatch and I want to create a metric filter to extract the reported time it takes Cloud Init to run.</p>
  
  <p>A sample log entry looks like:</p>
  
  <pre><code>Jun 24 12:06:51 ip-x-x-x-x [CLOUDINIT] util.py[DEBUG]: cloud-init mode 'modules' took 295.097 seconds (294.83)
  </code></pre>
  
  <p>And the value I would like to extract is: <code>295.097</code></p>
  
  <p>It seems pretty straight forward because <code>took [number] seconds</code> is unique to just this line. <a href="http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/FilterAndPatternSyntax.html" rel="noreferrer">This guide on metric filter syntax</a> seems to only show examples for extracting values from JSON logs and <a href="http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/MonitoringPolicyExamples.html" rel="noreferrer">this official example list</a> doesn't cover it.</p>
  
  <p>Based on the documentation, I figured something like:</p>
  
  <pre><code>[..., "took", seconds]
  </code></pre>
  
  <p>would work, but I haven't had much luck.</p>
  
  <p>Any help would be really appreciated!</p>