Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

An application running on AWS Fargate writes structured JSON logs to an Amazon CloudWatch Logs log group. A developer needs to track the frequency of database connection errors. A sample log event is shown below:

{
"timestamp": "2026-07-14T12:00:00Z",
"event_type": "database_connect",
"status": "error",
"latency_ms": 2500
}

Which actions must the developer take to configure the metric filter correctly? (Select TWO.)

  1. Define the metric filter pattern as `{ (.event_type = "database_connect") && (.status = "error") }`Answer
  2. Set the metric value of the metric transformation to `1`Answer
  3. C
    Define the metric filter pattern as `[timestamp, event_type="database_connect", status="error", latency_ms]`
  4. D
    Set the metric value of the metric transformation to `$.latency_ms`
  5. E
    Define the metric filter pattern using the query syntax `fields @timestamp, event_type | filter event_type = "database_connect" and status = "error"`

Answer

Define the metric filter pattern as `{ (.event_type = "database_connect") && (.status = "error") }` and set the metric value of the metric transformation to 1.
To create a metric filter for structured JSON logs, the pattern must follow CloudWatch's JSON syntax which utilizes curly braces `{}` and dot notation (`$.property`) to reference nested keys. The logical operator `&&` is used to join the two conditions. Additionally, since the goal is to count the frequency of occurrences of these errors, the metric value must be set to `1` so that the custom metric increments by 1 for every match.

Step-by-Step Solution

1
Determine the log event format to apply the correct filter pattern syntax.
Since the logs are structured in JSON, the filter pattern must use the JSON metric filter syntax (curly braces `{}` and `$.property` notation) instead of space-delimited or SQL-like syntax.
Applying the wrong filter syntax will result in zero matches and a failure to trigger metrics/alarms.
2
Construct the conditional expression for the filter pattern.
The correct pattern is `{ (.event_type = "database_connect") && (.status = "error") }` to target specific properties and require both conditions to be met.
This isolates the exact database connection failures needed for the metric.
3
Configure the metric transformation properties to count the events.
Set the metric value to `1` in the transformation configuration.
Using a value of 1 increments the metric count by 1 for each occurrence of the error. Using a variable field like latency would record response times rather than counting error frequency.

Key Concept

Creating CloudWatch metric filters for JSON logs to track frequency of events
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic