I couldn't get this rule to work. I ended up using a subscription instead:
aws logs put-subscription-filter \
--log-group-name $project_repo \
--filter-name "HealthCheckSuccessFilter" \
--filter-pattern "$NGINX_READY_MESSAGE" \
--destination-arn $FunctionArn