Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is monitoring a payment processing application deployed on Amazon EC2. The Unified CloudWatch Agent is configured to stream application logs to a CloudWatch Logs log group named `/aws/ec2/PaymentService`. The application outputs logs in the following JSON format:

{
"timestamp": "2026-07-14T12:00:00Z",
"status": "FAILED",
"executionTimeMs": 4500,
"errorDetails": {
"category": "GatewayTimeout",
"attempt": 3
}
}

The developer needs to create a CloudWatch Alarm that triggers when there are more than 5 occurrences of failed executions due to a `GatewayTimeout` where the number of attempts is greater than 2 within a 5-minute window.

Which of the following actions should the developer take to implement this monitoring solution? (Select TWO.)

  1. Create a CloudWatch Logs metric filter on the `/aws/ec2/PaymentService` log group with the filter pattern `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }`.Answer
  2. B
    Create a CloudWatch Logs metric filter on the `/aws/ec2/PaymentService` log group with the space-delimited filter pattern `[timestamp, status = "FAILED", executionTimeMs, category = "GatewayTimeout", attempt > 2]`.
  3. Create a CloudWatch Alarm that monitors the custom metric generated by the metric filter, configuring it to trigger when the metric value is greater than 5 within an evaluation period of 5 minutes.Answer
  4. D
    Create a CloudWatch Logs subscription filter with a destination of Amazon EventBridge, and configure an EventBridge rule to match the error patterns and route them to an alarm.
  5. E
    Configure the Unified CloudWatch Agent configuration file (`amazon-cloudwatch-agent.json`) on the EC2 instances with a custom metric parsing rule to extract the JSON properties and publish them directly to CloudWatch Metrics.

Answer

The developer should create a CloudWatch Logs metric filter using the JSON syntax `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }` and create a CloudWatch Alarm that monitors the metric and triggers when it is greater than 5 over a 5-minute evaluation period.
The correct options involve creating a metric filter with JSON syntax and establishing an alarm based on that filter's metric. The JSON syntax `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }` correctly parses the log structure to filter relevant log entries, and the alarm monitors the resulting metric over the 5-minute interval.

Step-by-Step Solution

1
Analyze the log structure to determine the appropriate CloudWatch Logs filter syntax.
The log format is JSON with nested fields under `errorDetails`.
Since the log is structured JSON, the developer must use CloudWatch Logs JSON filter syntax using curly braces `{}` rather than space-delimited square brackets `[]`.
2
Define the JSON filter pattern using standard property selectors.
The pattern is defined as `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }`.
This matches events where the top-level field `status` equals `FAILED`, the nested field `category` equals `GatewayTimeout`, and the nested field `attempt` is strictly greater than 2.
3
Configure a CloudWatch Alarm on the custom metric created by the metric filter.
A CloudWatch Alarm is configured to monitor the custom metric, evaluating if the metric exceeds the threshold of 5 within a 5-minute window.
Alarms are required to notify or take action when a metric crosses a specified threshold over a defined period of time.

Key Concept

CloudWatch Logs Metric Filters syntax and structure for JSON logs
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic