Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is troubleshooting an AWS Lambda function that occasionally fails. The developer wants to monitor these failures by creating a CloudWatch metric and alarm whenever the function times out. The Lambda function has a timeout configured for 15 seconds. The log stream contains the following log event:

`2026-07-14T12:00:00.000Z 8f029cfa-13e5-4b4f-8f81-540e7912a78f Task timed out after 15.02 seconds`

The developer configures a metric filter with the filter pattern `[timestamp, request_id, message = "Task timed out*"]` to increment a custom metric named `TimeoutCount`. However, the metric remains at 0 even after subsequent timeouts occur.

Which of the following actions should the developer take to resolve this issue and successfully track the timeouts? (Select TWO.)

  1. Update the metric filter pattern to "Task timed out" (with double quotes) to match the exact phrase anywhere in the log event.Answer
  2. Update the metric filter pattern to [timestamp, request_id, word1 = "Task", word2 = "timed", word3 = "out"] to correctly match the individual space-delimited words in the log entry.Answer
  3. C
    Grant cloudwatch:PutMetricData permissions to the Lambda function's IAM execution role so the function can publish the metric.
  4. D
    Increase the Lambda function's timeout configuration to 15 minutes to allow the metric filter enough time to process and publish the custom metric.
  5. E
    Update the metric filter pattern to [timestamp, request_id, message = "*Task timed out*"] to enable wildcard matching for the message field.

Answer

Update the metric filter pattern to "Task timed out" (with double quotes) and update the metric filter pattern to [timestamp, request_id, word1 = "Task", word2 = "timed", word3 = "out"].
The correct options are: updating the metric filter pattern to use the exact phrase "Task timed out" in double quotes, and updating the metric filter pattern to use individual space-delimited words. The first option works because enclosing a phrase in double quotes instructs CloudWatch Logs to search for the literal substring anywhere in the log event, bypassing field parsing. The second option works because it maps each space-separated term (e.g., 'Task', 'timed', 'out') to individual fields, matching the actual log structure.

Step-by-Step Solution

1
Analyze the log format and the failing filter pattern.
The log event is space-delimited: `2026-07-14T12:00:00.000Z 8f029cfa-13e5-4b4f-8f81-540e7912a78f Task timed out after 15.02 seconds`. The third field contains only 'Task', not the entire phrase 'Task timed out'.
Understanding why the current filter pattern `[timestamp, request_id, message = "Task timed out*"]` fails to match.
2
Identify correct string matching patterns in CloudWatch Logs.
Using a literal term search like `"Task timed out"` in double quotes matches the exact phrase anywhere in the log line.
Literal phrase matching is the simplest way to find multi-word strings without defining complex space-delimited fields.
3
Identify correct space-delimited field structures.
Represent the log event fields individually: `[timestamp, request_id, word1 = "Task", word2 = "timed", word3 = "out"]`.
This maps each space-separated word to a separate variable and matches them exactly, which is valid for space-delimited filtering.

Key Concept

CloudWatch Logs Metric Filter pattern syntax and space-delimited log parsing rules.
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic