Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is configuring an Amazon CloudWatch Logs subscription filter to stream logs from an application to an Amazon Kinesis Data Stream. The application logs are structured JSON documents that contain a root-level key `statusCode` and a nested object `errorInfo` with a key `severity`. The developer wants the subscription filter to select only log events where `statusCode` is 500 and `severity` is 'CRITICAL'. Which filter pattern must the developer use?

  1. { .statusCode = 500 && .errorInfo.severity = "CRITICAL" }Answer
  2. B
    { .statusCode==500AND.statusCode == 500 AND .errorInfo.severity == "CRITICAL" }
  3. C
    fields statusCode, errorInfo.severity | filter statusCode = 500 and errorInfo.severity = "CRITICAL"
  4. D
    [statusCode = 500, errorInfo.severity = "CRITICAL"]

Answer

The correct filter pattern is `{ .statusCode = 500 && .errorInfo.severity = "CRITICAL" }`.
The correct pattern `{ .statusCode = 500 && .errorInfo.severity = "CRITICAL" }` properly follows the CloudWatch Logs filter pattern syntax for JSON logs. It uses curly braces, dot notation for nested JSON properties, a single `=` for comparison, and `&&` for a logical AND relationship.

Step-by-Step Solution

1
Identify the format of the log events.
The log events are structured JSON documents.
This determines that the pattern must use curly braces `{ }` and JSONPath-like notation starting with `$.`.
2
Apply the correct comparison and logical operators for CloudWatch filter patterns.
Use `=` for equality and `&&` for the logical AND operation.
CloudWatch JSON filter patterns do not use `==` or keyword operators like `AND`.
3
Construct the path to the nested property.
`$.errorInfo.severity` is used to target the `severity` field inside the nested `errorInfo` object.
JSONPath syntax allows nested fields to be traversed using dot notation.

Key Concept

CloudWatch Logs Filter Pattern Syntax for JSON Log Events
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic