Examkin

Question

Difficulty: HardMonitoring and Analyzing Logs with Amazon CloudWatch

An application deployed in an Amazon ECS container on AWS Fargate uses the awslogs log driver to stream stdout logs to an Amazon CloudWatch Logs log group. The application outputs logs in JSON format, but the container's logging framework prepends a plaintext timestamp to each log line, resulting in log events formatted as follows:

`2026-07-14T12:00:00Z {"level": "ERROR", "response": {"status_code": 504, "error": "Gateway Timeout"}}`

The developer created a CloudWatch Metric Filter with the pattern `{ $.response.status_code = 504 }` to monitor these errors, but the metric is not registering any data. Which two actions should the developer take to resolve this issue and ensure the metrics are accurately captured?

  1. Configure the application's logging framework to output raw JSON without prepended plaintext.Answer
  2. Update the metric filter pattern to use a space-delimited text pattern, such as `[timestamp, json_payload = *status_code": 504*]`.Answer
  3. C
    Modify the metric filter pattern to `$.response.status_code = 504` without curly braces.
  4. D
    Migrate the application to AWS Lambda and implement a try-catch block inside the handler code to intercept execution timeouts and log a custom 504 error payload.
  5. E
    Add logs:PutLogEvents permissions to the ECS Task Role to authorize the metric filter to publish metrics to CloudWatch.

Answer

Configure the application's logging framework to output raw JSON without prepended plaintext, or update the metric filter pattern to use a space-delimited text pattern.
The correct options target the underlying parsing failure: either by rendering the log events as valid JSON so the JSON metric filter pattern can function, or by using a space-delimited pattern to extract the JSON substring and match the status code within it.

Step-by-Step Solution

1
Analyze why the JSON metric filter pattern is failing to match the log events.
The log event is prepended with a plaintext timestamp, which invalidates the JSON structure of the log event and prevents CloudWatch Logs from parsing it as valid JSON.
CloudWatch Logs JSON metric filters only work on log events that are valid JSON objects from the very first character.
2
Identify the first valid solution: modify the log format produced by the application.
Removing the prepended plaintext timestamp makes the entire log event a valid JSON object starting with curly braces.
This allows the existing JSON metric filter pattern to parse and match the JSON fields correctly.
3
Identify the second valid solution: adjust the metric filter pattern to match the actual log format without modifying the application configuration.
Using a space-delimited filter pattern successfully parses the timestamp and matches the JSON string payload.
This maps the log event fields to position-based tokens, where the first token is the timestamp and the second is the JSON payload containing the targeted status code.

Key Concept

CloudWatch Logs Metric Filters require strict syntax matching: JSON filters require valid JSON log events enclosed in curly braces, while mixed or non-JSON logs must be parsed using space-delimited filter patterns.
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic