Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is monitoring a serverless application where the Lambda functions write structured JSON log events to Amazon CloudWatch Logs. A sample log event is shown below:

{
"request_id": "req-98765",
"status": "Failure",
"http_status": 504
}

The developer attempts to create a CloudWatch Metric Filter to count the occurrences of gateway timeouts where the request has a status of "Failure" and an http_status of 504. The developer configures the following filter pattern:

`{ .status == "Failure" && .http_status == 504 }`

After applying this filter, the metric is not populated even though log events matching these criteria are present in the log group. Which of the following explains why the metric filter is failing to match the log events?

  1. The metric filter pattern uses double equal signs for comparison, which is invalid syntax; the pattern must use a single equal sign for equality comparison.Answer
  2. B
    The filter pattern must use space-delimited syntax enclosed in square brackets because CloudWatch Logs does not natively parse JSON log structures.
  3. C
    The double ampersand operator is not supported in CloudWatch metric filters; logical operations must be split into separate, single-condition metric filters.
  4. D
    The Lambda function's IAM execution role lacks permissions to publish to the metric filter, preventing the filter from being evaluated as logs are written.

Answer

The metric filter pattern uses double equal signs for comparison, which is invalid syntax; the pattern must use a single equal sign for equality comparison.
The correct option is correct because Amazon CloudWatch Logs JSON metric filters utilize a single equal sign (=) for matching field values. The use of a double equal sign (==) is unsupported and results in the filter failing to match the JSON log events, leaving the metric unpopulated.

Step-by-Step Solution

1
Analyze the log format and the proposed CloudWatch Metric Filter pattern.
The log format is structured JSON, and the filter pattern uses JSON path syntax: `{ .status == "Failure" && .http_status == 504 }`.
This helps determine the correct filtering rules (curly braces for JSON structures).
2
Evaluate the syntax of the comparison operators within the filter pattern.
The developer specified `==` to verify equality for both `status` and `http_status` fields.
The syntax rules of CloudWatch Metric Filters dictate which symbols are allowed for logical and comparison operators.
3
Compare the query operator with CloudWatch specifications.
CloudWatch Logs metric filter syntax uses a single `=` for equality comparisons. The double equal sign `==` is not recognized, resulting in zero matches.
Correcting the syntax to `{ .status = "Failure" && .http_status = 504 }` allows CloudWatch to correctly parse and match the JSON log fields.

Key Concept

CloudWatch Logs Metric Filter JSON Syntax and Operators
Estimated Time:1m 30s
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic