how to match multiple patterns in aws cloudwatch log to trigger a lambda

Question

I'm trying to set a cloudwatch event to trigger a lambda function, I wan to trigger it when the message in the logs is either 'Process exited before completing request' or 'Error Runtime exited with error signal killed'.

Specifying one is easy, and it works fine (using a serverless.yml file)

      - cloudwatchLog:
      logGroup: '/aws/lambda/hello'
      filter: 'Error Runtime exited with error signal killed'

but I need the event to trigger for both messages, what is the right syntax to use an OR filter?

     - cloudwatchLog:
      logGroup: '/aws/lambda/hello'
      filter: 'Process exited before completing request' OR 'Error Runtime exited' with error signal killed' 

I've tried with '[Process exited before completing request, Error Runtime exited]' but that doesn't work, aws docummendation specifies how to match one word or another but not complete sentences like this ones

Answer 1

this works:

- cloudwatchLog:
  logGroup: '/aws/lambda/hello'
  filter: '[(message="*Process exited before completing*") || (message="*signal: killed*") || (message="*Runtime.ExitError*")]'