Hi, I’m currently trying my hand at Localstack (PRO) and Cloudwatch 
I just can’t get it to make the right selection. I log with the json formatter with serilog.
My log output (one message from many) looks like this:
{
“Timestamp”:“2024-05-17T10:03:26.4633689+02:00”,
“Level”: “Information”,
“MessageTemplate”:“{@message}”,
“TraceId”:“4203f3c93565909e71002ff37445b2d8”,
“SpanId”:“6e7b8396d36a6567”,
“Properties”:{
“message”:{
“MessageId”:“86262c9f-ecdb-4adc-b01b-08a0ec8eb2fe”,
“Created”:“2024-05-17T08:03:26.4589201Z”,
“UserId”:“7c47a307-34cc-46c4-9081-2385cee6fcd7”,
“Index”:1696322064589201,
“ShouldBeHidden”:false,
“_typeTag”: “ImpoertantMessage”
},
“SourceContext”: “Client.PersistingMessageClient”,
}
}
This is the message . I only want to have logs where _typeTag = “ImpoertantMessage” and a specific userId. This information is in the message within Properties.
However, I also have logs that do not have this structure, i.e. properties are not always present.
What should such a selection look like? I tried it both with the localstack CLI and from C#, but couldn’t get it right.
Thanks for the help!