Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is troubleshooting an application that writes space-delimited log events to an Amazon CloudWatch Logs log group. A sample log event is:

`2026-07-14T12:00:00Z INFO 192.168.1.50 GET /index.html 200 125`

The fields in the log event represent the timestamp, severity, client IP address, HTTP method, resource path, status code, and response time in milliseconds, in that order.

The developer wants to create a CloudWatch Logs metric filter that counts all requests where either the status code is 500500 or the response time is greater than 500 ms500\text{ ms}.

Which of the following filter patterns must the developer use to correctly implement this metric filter?

  1. A
    [timestamp, severity, client_ip, method, resource, status_code = 500 OR response_time_ms > 500]
  2. B
    { .statuscode=500∣∣.status_code = 500 || .response_time_ms > 500 }
  3. [timestamp, severity, client_ip, method, resource, status_code = 500 || response_time_ms > 500]Answer
  4. D
    fields status_code, response_time_ms | filter status_code = 500 or response_time_ms > 500

Answer

The filter pattern starting with square brackets and using the double pipe operator '||' to combine the field conditions.
The correct answer defines the space-delimited fields sequentially inside square brackets, assigning names to each position. It uses the correct logical OR operator '||' to combine the conditions for the status code and response time fields.

Step-by-Step Solution

1
Identify the format of the log events in the log group.
The log events are space-delimited text, not JSON-formatted.
Knowing the log format determines whether to use bracket syntax `[...]` for space-delimited logs or curly brace syntax `{...}` for JSON logs.
2
Map the log fields to their corresponding positions inside the brackets.
The fields must be defined in the correct order: `timestamp`, `severity`, `client_ip`, `method`, `resource`, `status_code`, and `response_time_ms`.
Space-delimited log patterns match fields by position from left to right.
3
Construct the logical condition with the correct filter syntax.
The condition uses the `=` and `>` operators, combined with the logical OR operator `||` inside the brackets.
CloudWatch Logs metric filters require the logical operators `||` (OR) and `&&` (AND) for multiple conditions, and do not accept SQL keywords like 'OR'.

Key Concept

CloudWatch Logs metric filter pattern syntax for space-delimited logs.
Estimated Time:1m 30s
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic