Examkin

Question

Difficulty: EasyMonitoring and Analyzing Logs with Amazon CloudWatch

A developer wants to create an Amazon CloudWatch metric filter to count occurrences of the term 'AccessDenied' in a plain text log group. The developer attempts to use the following CloudWatch Logs Insights query syntax as the metric filter pattern:

`fields @message | filter @message like /AccessDenied/`

However, the metric is not being incremented even when 'AccessDenied' appears in the logs.

Which of the following is the correct explanation and resolution for this issue?

  1. Metric filters do not support CloudWatch Logs Insights query syntax. The filter pattern should be changed to the literal string 'AccessDenied'.Answer
  2. B
    Metric filters can only parse JSON-formatted logs. The developer must convert the application's logging library output to JSON format to use metric filters.
  3. C
    The metric filter pattern is correct, but the metric does not increment because the IAM execution role of the application generating the logs lacks the 'logs:StartQuery' permission.
  4. D
    The metric filter failed to process the logs because the log group's processing duration exceeded the default execution timeout of the underlying log parser.

Answer

Metric filters do not support CloudWatch Logs Insights query syntax. The filter pattern should be changed to the literal string 'AccessDenied'.
The correct answer is correct because CloudWatch Logs metric filters and CloudWatch Logs Insights are two distinct features with different syntaxes. Metric filters scan logs during ingestion using basic string matching patterns or JSON properties, and they do not understand the pipe-separated query syntax of Logs Insights. By changing the pattern to the simple string 'AccessDenied', the filter will correctly match any log line containing that term.

Step-by-Step Solution

1
Analyze the configured filter pattern syntax.
The developer configured the metric filter pattern with 'fields @message | filter @message like /AccessDenied/', which is a query string designed for CloudWatch Logs Insights.
Identifying the syntax type helps determine if it is compatible with the target service feature (Metric Filters).
2
Determine compatibility of Logs Insights query syntax with CloudWatch metric filters.
CloudWatch Logs metric filters do not support pipe-delimited query commands or the Logs Insights syntax. They support simple terms, phrases, or JSON object patterns.
Understanding the feature limitations explains why the current configuration is failing to match any log events.
3
Identify the correct syntax for a basic term match in plain text logs.
For a plain text log, to match a specific keyword, the metric filter pattern should be configured with the keyword itself (e.g., 'AccessDenied' or '"AccessDenied"').
Replacing the invalid query syntax with the correct metric filter pattern resolves the issue and allows the metric to increment.

Key Concept

CloudWatch Logs metric filters use a simple term-matching or JSON-matching syntax and do not support CloudWatch Logs Insights query syntax.
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic