3 ways to catch all the events going through the EventBridge Event Bus

For some requirements, you will need to record all the events that go through your EventBridge Event Bus. CloudWatch can be a suitable target for this. https://repost.aws/knowledge-center/cloudwatch-log-group-eventbridge

In this blog post, I am going to discuss how we can implement 3 different rules that can be used to implement catch-all functionality for a EventBridge event bus.

Using prefix

You can use the “prefix” pattern matching feature of the EventBridge rule to capture all the events.
Keeping the prefix value to an empty string will do the trick.

EventRuleCatchAllWithPrefix:
    Type: AWS::Events::Rule
    Properties:
      Description: "EventRule to catch all using prefix"
      EventBusName: !Ref MyEventBus
      EventPattern:
        source:
          - prefix: ""
      Targets:
        - Arn: !GetAtt CatchAllWithPrefixLogGroup.Arn
          Id: "TargetCatchAllWithPrefix"

Refers docs of prefix pattern here: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-patterns-content-based-filtering.html#eb-filtering-prefix-matching

In this example, I have used the field “source” to apply the prefix filter since each and every event going through an event bus will have a source field. As an alternative, you may use any field that exists in the event.

Using version

Similar to the prefix matching, we can exactly match the “version” of the event to capture all the events. For all the events going through Event Bus will include the version field with value 0. As of now, there are no other version values available other than 0, but this might change in future.

Here is an example how you can define the catch all rule with exactly matching the version.

EventRuleCatchAllWithVersion:
    Type: AWS::Events::Rule
    Properties:
      Description: "EventRule to catch all using version"
      EventBusName: !Ref MyEventBus
      EventPattern:
        version: ["0"]
      Targets:
        - Arn: !GetAtt CatchAllWithVersionLogGroup.Arn
          Id: "TargetCatchAllWithVersion"

Using wildcard

EventBridge recently announced the support for wildcards in their event rules (https://aws.amazon.com/about-aws/whats-new/2023/10/amazon-eventbridge-wildcard-filters-rules/).

We can use this to form the catch all rule as follows. Use any field that exists in the event all the time (here, the “source” field) and apply the wildcard “*”.

EventRuleCatchAllWithWildcard:
    Type: AWS::Events::Rule
    Properties:
      Description: "EventRule to catch all using wildcard"
      EventBusName: !Ref MyEventBus
      EventPattern:
        source:
          - wildcard: "*"
      Targets:
        - Arn: !GetAtt CatchAllWithWildcardLogGroup.Arn
          Id: "TargetCatchAllWithWildcard"

Refer docs of wildcard pattern here: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-patterns-content-based-filtering.html#eb-filtering-wildcard-matching

Try this yourself

Here is the Github repository I created to show this functionality. You can deploy this into your AWS environment using AWS SAM CLI.

https://github.com/pubudusj/eventbridge-catch-all

Once deployed, it will create an Event Bus, 3 different rules as discussed above and 3 different CloudWatch Logs as targets for those rules.

When you send any message into the event bus, you can see them end up in all the CloudWatch Logs.

Summary

AWS is well known for providing more than one method to achieve the same results. This is one of the examples, where you can implement a catch all functionality for your event bus defining rules in 3 different ways.