Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is monitoring a web application that writes log events to an Amazon CloudWatch Logs log group in the following JSON format:

{
"requestPath": "/payment/process",
"responseCode": 502,
"responseTimeMs": 1500
}

The developer needs to configure a CloudWatch metric filter to count the occurrences of failed payment requests where the `responseCode` is 502502 and the `responseTimeMs` is greater than 10001000 milliseconds.

Which of the following configurations are valid for this metric filter or represent correct troubleshooting actions to ensure the filter works as intended? (Select TWO.)

  1. Define the metric filter pattern as `{ .responseCode = 502 && .responseTimeMs > 1000 }` to match the JSON properties.Answer
  2. B
    Define the metric filter pattern as `{ .responseCode == 502 && .responseTimeMs > 1000 }` to compare the properties.
  3. C
    Define the metric filter pattern as `[responseCode = 502, responseTimeMs > 1000]` to filter the log events.
  4. Ensure that all application logs are written as valid JSON objects, as the JSON filter pattern will ignore malformed JSON or plain text.Answer
  5. E
    Increase the execution timeout of the AWS Lambda function parsing the logs to prevent the metric filter from timing out.

Answer

The correct configurations are defining the metric filter pattern as `{ .responseCode = 502 && .responseTimeMs > 1000 }` and ensuring that all application logs are written as valid JSON objects.
The correct choices are using the single equals operator (`=`) inside curly braces to query JSON properties, and ensuring the log events are valid JSON. CloudWatch JSON metric filter syntax requires a single equals sign for comparison and will completely ignore log events that do not conform to valid JSON formatting.

Step-by-Step Solution

1
Analyze the format of the incoming logs to determine the appropriate filter syntax.
The logs are structured in JSON format, which means curly brace syntax `{ ... }` must be used instead of space-delimited bracket syntax `[ ... ]`.
CloudWatch Logs treats JSON and space-delimited logs differently, and using the wrong syntax results in zero matches.
2
Review the comparison operator syntax for JSON metric filters.
Confirm that a single equals sign (`=`) is the valid comparison operator for matching property values in JSON filter patterns.
Programming-style double equals (`==`) is invalid in CloudWatch filter patterns and will prevent correct evaluation.
3
Verify log ingestion format constraints.
Ensure all log entries are valid, well-formed JSON objects.
If a log entry contains malformed JSON, CloudWatch Logs will fail to parse the fields, and the filter pattern will not match the event.

Key Concept

JSON Metric Filter Syntax and Validation in CloudWatch Logs
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic