title: AWS Cloudwatch Filter and Pattern Syntax Issue
body: <p>I followed the instructions here <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html</a></p>
  <p>but it's not working as i'm expecting it to. I'm trying to create following pattern [..., Query_time&gt;1800,], but not working. I need the logs having query time greater than 1800.</p>
  <p>Below is the cloudwatch log:</p>
  <pre><code># Time: 210126  5:31:49 # User@Host: et_user[et_user] @  [127.0.0.1]  Id: 458426829 # Query_time: 6.408787  Lock_time: 0.000206 Rows_sent: 1  Rows_examined: 19439654 SET timestamp=1611639109; SELECT                                 COUNT(DISTINCT v.customer_id) AS total_registrations,                                 COUNT(r.id) AS total_savings,                                 SUM(r.savings_estimate) AS total_estimated_savings                             FROM web_ten.`validation` v                                 LEFT OUTER JOIN web_ten.`savings` r ON v.user_id = r.user_id AND r.status=1                                     AND r.company LIKE 'ABDSDF%'                                     LEFT OUTER JOIN `web_ten`.outlet AS o ON r.outlet_id = o.id                                     AND o.user_id NOT IN (SELECT id FROM `web_ten`.`user` WHERE is_tutorial = 1)                             WHERE                                   v.isused = 1 AND no_company = 'ABDSDF'                                    AND v.email NOT IN (                                         SELECT `email` FROM `web_ten`.excluded_demo_emails                                     );
  # User@Host: et_user_test[et_user_test] @  [127.0.0.1]  Id: 453140660 # Query_time: 2.018429  Lock_time: 0.000051 Rows_sent: 0  Rows_examined: 743405 use production; SET timestamp=1611639131; UPDATE `web_ten`.`pm_user_order` SET `cron_processing`=0 WHERE `id` &gt; 0;
  </code></pre>