Examkin

Question

Difficulty: EasyMonitoring and Analyzing Logs with Amazon CloudWatch

An order processing system publishes JSON-formatted logs to Amazon CloudWatch Logs. The logs contain a top-level key named `status`. A representative log event is:

{
"orderId": "1001",
"status": "Failed",
"code": 500
}

Which filter pattern should be applied to the log group to capture these specific events?

  1. { $.status = "Failed" }Answer
  2. B
    $.status = "Failed"
  3. C
    [status = "Failed"]
  4. D
    { status == "Failed" }

Answer

The correct filter pattern is `{ $.status = "Failed" }`.
The correct pattern is `{ .status = "Failed" }` because structured JSON logs in CloudWatch Logs must be queried with patterns enclosed in curly braces. Within the braces, the root object is represented by ``, followed by the key name (e.g., `$.status`), and a single equals sign `=` is used for string or numeric value comparison.

Step-by-Step Solution

1
Identify the log format
The log event is structured in JSON format.
JSON logs require different metric filter syntax rules compared to space-delimited text logs.
2
Determine the root selector and curly braces rule
CloudWatch JSON log filters must be enclosed in curly braces `{}` and refer to the root document using `$`.
Without braces and the root selector, CloudWatch cannot parse the JSON path correctly.
3
Determine the comparison operator
A single equals sign `=` is used for equality comparison.
CloudWatch Metric Filter syntax specifies `=` as the equality operator for string or numeric matching.

Key Concept

CloudWatch Logs Metric Filter JSON Syntax
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic