CloudWatch I don’t know that well, but, from your earlier thread, it looks like support for raw_message might not be fully tested.
I’d suggest marking the current thread as Solved and then creating a new top-level thread for that separate (and possibly much thornier) problem. The Questions / Help category is the best place for such things.
(If you link to the March thread from the new one, then casual readers will have more context. This will improve the odds that someone will happen to see the solution while glancing through, etc.)