We used metric log filters in this recipe. We can use metric log filters to match terms, phrases, and values in the log events. When a match is made, we can increment the value of a CloudWatch metric. For example, we can create a metric log filter to count the occurrence of the word ERROR. 

Metric filters can also extract numerical values from space-delimited log events, and in such cases, we can increment our metric value by the actual numerical value from the log. We can also use conditional operators and wildcards for matches.

We also looked at metric log creation from the CloudWatch console, and learned how it gives us the additional capability to test our search patterns against existing data. 

Log filters do not work on data that was already sent to CloudWatch, but only on data sent after the filter was created. At the time of writing, log filters will only return the first 50 results.