feat(logs): support regex patterns for JSON Metrics filters (#30741)

### Issue # (if applicable)

Closes #30451 

### Reason for this change

Support Regex in filter functions for JSON

### Description of changes

Adding a new JSONPattern factory that uses `%` instead of `"` to support the regex pattern.

### Description of how you validated changes

I tried it in our own CDK code. 

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: jan-xyz

packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.metricfilter.lit.js.snapshot/aws-cdk-metricfilter-integ.template.json

@@ -11,7 +11,7 @@
   "MetricFilter1B93B6E5": {
    "Type": "AWS::Logs::MetricFilter",
    "Properties": {
-    "FilterPattern": "{ $.latency = \"*\" }",
+    "FilterPattern": "{ ($.latency = \"*\") && ($.message = %bind: address already in use%) }",
     "LogGroupName": {
      "Ref": "LogGroupF5B46931"
     },

packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.metricfilter.lit.ts

@@ -15,7 +15,10 @@ class MetricFilterIntegStack extends Stack {
       metricNamespace: 'MyApp',
       metricName: 'Latency',
       filterName: 'MyFilterName',
-      filterPattern: FilterPattern.exists('$.latency'),
+      filterPattern: FilterPattern.all(
+        FilterPattern.exists('$.latency'),
+        FilterPattern.regexValue('$.message', '=', 'bind: address already in use'),
+      ),
       metricValue: '$.latency',
     });
     /// !hide

packages/aws-cdk-lib/aws-logs/README.md

@@ -295,6 +295,8 @@ and then descending into it, such as `$.field` or `$.list[0].field`.
 
 * `FilterPattern.stringValue(field, comparison, string)`: matches if the given
   field compares as indicated with the given string value.
+* `FilterPattern.regexValue(field, comparison, string)`: matches if the given
+  field compares as indicated with the given regex pattern.
 * `FilterPattern.numberValue(field, comparison, number)`: matches if the given
   field compares as indicated with the given numerical value.
 * `FilterPattern.isNull(field)`: matches if the given field exists and has the
@@ -324,6 +326,7 @@ const pattern = logs.FilterPattern.all(
     logs.FilterPattern.booleanValue('$.error', true),
     logs.FilterPattern.numberValue('$.latency', '>', 1000),
   ),
+  logs.FilterPattern.regexValue('$.message', '=', 'bind address already in use'),
 );
 ```
 

packages/aws-cdk-lib/aws-logs/lib/pattern.ts

@@ -116,6 +116,27 @@ export class FilterPattern {
     return new JSONNumberPattern(jsonField, comparison, value);
   }
 
+  /**
+   * A JSON log pattern that compares against a Regex values.
+   *
+   * This pattern only matches if the event is a JSON event, and the indicated field inside
+   * compares with the regex value.
+   *
+   * Use '$' to indicate the root of the JSON structure. The comparison operator can only
+   * compare equality or inequality.
+   *
+   * For more information, see:
+   *
+   * https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
+   *
+   * @param jsonField Field inside JSON. Example: "$.myField"
+   * @param comparison Comparison to carry out. Either = or !=.
+   * @param value The regex value to compare to.
+   */
+  public static regexValue(jsonField: string, comparison: string, value: string): JsonPattern {
+    return new JSONRegexPattern(jsonField, comparison, value);
+  }
+
   /**
    * A JSON log pattern that matches if the field exists and has the special value 'null'.
    *
@@ -225,6 +246,16 @@ class JSONStringPattern extends JsonPattern {
   }
 }
 
+/**
+ * A regex comparison for JSON patterns
+ */
+class JSONRegexPattern extends JsonPattern {
+  public constructor(jsonField: string, comparison: string, value: string) {
+    // No validation, we assume these are generated by trusted factory functions
+    super(`${jsonField} ${comparison} %${value}%`);
+  }
+}
+
 /**
  * A number comparison for JSON values
  */
@@ -260,7 +291,7 @@ class JSONAggregatePattern extends JsonPattern {
   }
 }
 
-export type RestrictionMap = {[column: string]: ColumnRestriction[]};
+export type RestrictionMap = { [column: string]: ColumnRestriction[] };
 
 const COL_ELLIPSIS = '...';
 

packages/aws-cdk-lib/aws-logs/test/integ.metricfilter.lit.ts

@@ -14,7 +14,10 @@ class MetricFilterIntegStack extends Stack {
       logGroup,
       metricNamespace: 'MyApp',
       metricName: 'Latency',
-      filterPattern: FilterPattern.exists('$.latency'),
+      filterPattern: FilterPattern.all(
+        FilterPattern.exists('$.latency'),
+        FilterPattern.regexValue('$.message', '=', 'bind: address already in use'),
+      ),
       metricValue: '$.latency',
     });
     /// !hide

packages/aws-cdk-lib/aws-logs/test/pattern.test.ts

@@ -51,6 +51,12 @@ describe('pattern', () => {
       expect('{ $.field = "value" }').toEqual(pattern.logPatternString);
     });
 
+    test('regex pattern', () => {
+      const pattern = FilterPattern.regexValue('$.field', '=', 'value');
+
+      expect('{ $.field = %value% }').toEqual(pattern.logPatternString);
+    });
+
     test('number patterns', () => {
       const pattern = FilterPattern.numberValue('$.field', '<=', 300);