AWS::Logs::MetricFilter:

Properties: 
  FilterPattern: |
    ["timestamps", "ip_addresses", "error_codes = 1234*", "size", "..."]
  LogGroupName: "\"The name of an existing log group that you want to associate with this metric filter.\""
  MetricTransformations: |
   [
     {
       "MetricName" => "The name of the CloudWatch metric to which the log information will be published.",
       "MetricNamespace" => "The destination namespace of the CloudWatch metric. Namespaces are containers for metrics. For example, you can add related metrics in the same namespace.",
       "MetricValue" => "The value that is published to the CloudWatch metric. For example, if you're counting the occurrences of a particular term like Error, specify 1 for the metric value. If you're counting the number of bytes transferred, reference the value that is in the log event by using $ followed by the name of the field that you specified in the filter pattern, such as $size."
     }
   ]