What is the reason that no filtered results are being returned?
A setup of the Amazon CloudWatch interface VPC endpoint is required for filtering the CloudWatch Logs in the VPC.
CloudWatch Logs only publishes metric data for events that happen after the filter is created.
The log group for CloudWatch Logs should be first streamed to Amazon OpenSearch Service before metric filtering returns the results.
Metric data points for logs groups can be filtered only after they are exported to an Amazon S3 bucket.
Explanations:
Setting up an Amazon CloudWatch interface VPC endpoint is not required for filtering logs. This option does not impact the ability to apply metric filters to CloudWatch Logs.
CloudWatch Logs metric filters only capture data from logs generated after the filter is created. If no results are returned, it may be because the logs containing the exceptions were recorded before the metric filter was applied.
There is no requirement to stream CloudWatch Logs to Amazon OpenSearch Service to use metric filters. Metric filters can be directly applied to CloudWatch Logs without needing OpenSearch.
Metric data points can be filtered directly in CloudWatch Logs without needing to export them to an S3 bucket. Exporting to S3 is not required for filtering logs.
I surmise that the answer is:
CloudWatch Logs only publishes metric data for events that happen after the filter is created.