title: Cloudwatch Log Alert - How to include error / exception / stack trace data in email notification
body: <p>I just configured Cloudwatch logs on my ec2 instances and am loving it so far. I also set up alerts for certain keywords, like "ERROR". While the email alert seems to be working fine, I was wondering if there's a way to fine-tune the alert email to make it a little concise &amp; informative. Specifically, I'm looking to</p>
  
  <ol>
  <li><p>Get rid of all the boilerplate text in the alert email. </p></li>
  <li><p>Include some information about the Error/Exception that triggered the alert. This could be something as simple as including the log statement that generated the alert. </p></li>
  </ol>
  
  <p>Right now, the alert email looks like</p>
  
  <blockquote>
    <p>You are receiving this email because your Amazon CloudWatch Alarm
    "App-Error-Alarm" in the US East - N. Virginia region has entered the
    ALARM state, because "Threshold Crossed: 1 datapoint (1.0) was greater
    than or equal to the threshold (1.0)." at "Tuesday 07 February, 2017
    16:39:43 UTC".</p>
    
    <p>View this alarm in the AWS Management Console:
    <a href="https://console.aws.amazon.com/cloudwatch/home?region=us-east-1#s=Alarms&amp;alarm=App-Error-Alarm" rel="noreferrer">https://console.aws.amazon.com/cloudwatch/home?region=us-east-1#s=Alarms&amp;alarm=App-Error-Alarm</a></p>
    
    <p>Alarm Details:
    - Name: App-Error-Alarm
    - Description: Errors in app.log
    - State Change: INSUFFICIENT_DATA -> ALARM
    - Reason for State Change: Threshold Crossed: 1 datapoint (1.0) was greater than or equal to the threshold (1.0).
    - Timestamp: Tuesday 07 February, 2017 16:39:43 UTC
    - AWS Account: &lt;></p>
    
    <p>Threshold:
    - The alarm is in the ALARM state when the metric is GreaterThanOrEqualToThreshold 1.0 for 300 seconds. </p>
    
    <p>Monitored Metric:
    - MetricNamespace: LogMetrics
    - MetricName: ERROR
    - Dimensions: 
    - Period: 300 seconds
    - Statistic: Sum
    - Unit: not specified</p>
    
    <p>State Change Actions:
    - OK: 
    - ALARM: [arn:aws:sns:us-east-1:&lt;>:support]
    - INSUFFICIENT_DATA:</p>
  </blockquote>
  
  <p>I'd like it to something like </p>
  
  <blockquote>
    <p>Alarm: App-Error-Alarm </p>
    
    <p>Keyword: "ERROR" </p>
    
    <p>Reason: ERROR 2017-02-07 07:31:47,375 [SimpleAsyncTaskExecutor-5]
    com.app.server.rest.Watcher: javax.net.ssl.SSLHandshakeException:
    Received fatal alert: handshake_failure</p>
  </blockquote>
  
  <p>Its short, sweet and instantly tells me whether its something that needs my immediate attention. Can this be done without writing code as suggested <a href="https://stackoverflow.com/questions/32612967/can-i-include-custom-data-in-a-aws-cloudwatch-alert">here</a>? </p>