Examkin

Question

Difficulty: HardMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is troubleshooting an application that streams JSON logs to an Amazon CloudWatch Logs log group. A representative log event in the log group is structured as follows:

{
"timestamp": "2026-07-14T12:00:00Z",
"level": "ERROR",
"error": {
"code": "DB_CONNECTION_FAILED",
"message": "Failed to connect to the database instance."
}
}

The developer created a CloudWatch metric filter with the pattern `{ $.error = "DB_CONNECTION_FAILED" }` to monitor database connection failures. However, the associated metric is not being populated, even though matching error logs are visible in the log group. What is the reason for this behavior?

  1. The filter pattern references the parent error object rather than the nested code property. It should be updated to { $.error.code = "DB_CONNECTION_FAILED" }.Answer
  2. B
    The filter pattern must use the SQL-like LIKE operator instead of = for string matching within JSON structures, formatted as { $.error.code LIKE "%DB_CONNECTION_FAILED%" }.
  3. C
    The filter pattern must be written in the space-delimited format [timestamp, level, error = "DB_CONNECTION_FAILED"] because CloudWatch cannot parse JSON objects natively without a pre-defined schema.
  4. D
    The application's execution context is reusing stale connections that timed out, preventing CloudWatch Logs from receiving the status code payload entirely.

Answer

The filter pattern references the parent error object rather than the nested code property. It should be updated to { $.error.code = "DB_CONNECTION_FAILED" }.
The correct answer explains that CloudWatch Logs requires a fully qualified JSON path to target a leaf node. The developer's pattern references the parent object 'error' (which evaluates to a nested map/dictionary) instead of the string property 'code'. By correcting the path to $.error.code, CloudWatch is able to successfully perform the equality comparison with the string 'DB_CONNECTION_FAILED'.

Step-by-Step Solution

1
Analyze the structured JSON log format to identify the path to the target error code.
The target string "DB_CONNECTION_FAILED" is located at the path $.error.code.
Correctly identifying the JSON hierarchy is required because CloudWatch Logs metric filters require complete JSON paths to match values.
2
Evaluate the developer's filter pattern { $.error = "DB_CONNECTION_FAILED" } against the JSON log hierarchy.
The selector $.error evaluates to the object { "code": "DB_CONNECTION_FAILED", "message": "Failed to connect to the database instance." }, which is not equal to the string "DB_CONNECTION_FAILED".
Understanding why the match fails requires evaluating the selector path's return type against the target value.
3
Select the option that fixes the path referencing issue using valid CloudWatch Logs metric filter syntax.
Updating the filter pattern to { $.error.code = "DB_CONNECTION_FAILED" } correctly compares the leaf node's string value.
This establishes a direct match on the string field, resolving the zero match issue.

Key Concept

CloudWatch Logs JSON Metric Filter Path Syntax
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic