add filter_pattern param

README.md

@@ -31,6 +31,7 @@ and ingest all logs available in all of the matching groups.
 | session_token | string | No | |
 | region | string | No | `us-east-1` |
 | codec | string | No | `plain` |
+| filter_pattern | string | No | `` |
 
 #### `start_position`
 The `start_position` setting allows you to specify where to begin processing
@@ -42,6 +43,9 @@ Valid options for `start_position` are:
 * `beginning` - Reads from the beginning of the group (default)
 * `end` - Sets the sincedb to now, and reads any new messages going forward
 * Integer - Number of seconds in the past to begin reading at
+#### `filter_pattern`
+[Filter and Pattern Syntax.](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html)
+
 
 #### Logstash Default config params
 Other standard logstash parameters are available such as:

lib/logstash/inputs/cloudwatch_logs.rb

@@ -50,6 +50,9 @@ class LogStash::Inputs::CloudWatch_Logs < LogStash::Inputs::Base
   # seconds before now to read back from.
   config :start_position, :default => 'beginning'
 
+  # The filter pattern to use. For more information, see Filter and Pattern Syntax.
+  # If not provided, all the events are matched.
+  config :filter_pattern, :validate => :string, :default => ""
 
   # def register
   public
@@ -187,8 +190,10 @@ def process_group(group)
           :log_group_name => group,
           :start_time => @sincedb[group],
           :interleaved => true,
-          :next_token => next_token
+          :next_token => next_token,
+          :filter_pattern => filter_pattern
       }
+
       resp = @cloudwatch.filter_log_events(params)
 
       resp.events.each do |event|