Examkin

Question

Difficulty: HardMonitoring and Analyzing Logs with Amazon CloudWatch

An application deployed on Amazon EC2 instances streams its log files to an Amazon CloudWatch Logs log group named `/aws/ec2/app-logs` using the Unified CloudWatch Agent. The application logs are structured as JSON objects, with the following format:

{
"timestamp": "2026-07-14T10:00:00Z",
"status": "FAIL",
"errorCode": 401,
"latency_ms": 150
}

A developer needs to configure a CloudWatch metric filter to track the number of failed login attempts where the `status` is `"FAIL"` and the `errorCode` is `401`. Additionally, the developer needs to run a CloudWatch Logs Insights query to find the 90th percentile of `latency_ms` for these specific failed login events, grouped into 15-minute intervals over the last 24 hours.

Which two options should the developer use to accomplish these tasks? (Select TWO.)

  1. A CloudWatch metric filter with the pattern `{ .status = "FAIL" && .errorCode = 401 }` to track the occurrences of failed loginsAnswer
  2. B
    A CloudWatch metric filter with the pattern `[status = "FAIL", errorCode = 401]` to track the occurrences of failed logins
  3. A CloudWatch Logs Insights query:

    fields @timestamp, latency_ms
    | filter status = "FAIL" and errorCode = 401
    | stats pct(latency_ms, 90) by bin(15m)
    Answer
  4. D
    A CloudWatch Logs Insights query:

    fields @timestamp, latency_ms
    | filter status == "FAIL" and errorCode == 401
    | stats percentile(latency_ms, 90) group by 15m
  5. E
    A CloudWatch metric filter with the pattern `{ status: "FAIL", errorCode: 401 }` to track the occurrences of failed logins

Answer

The correct configurations are the metric filter with the pattern `{ .status = "FAIL" && .errorCode = 401 }` and the CloudWatch Logs Insights query that uses the `pct(latency_ms, 90)` function grouped `by bin(15m)`.
The correct metric filter configuration uses the correct JSON filter syntax `{ .status = "FAIL" && .errorCode = 401 }` to inspect JSON log properties. The correct CloudWatch Logs Insights query filters for the failed status and error code, then uses the `pct()` function to find the 90th percentile of latency grouped in 15-minute intervals using `by bin(15m)`.

Step-by-Step Solution

1
Analyze the JSON log format to identify the property names: status, errorCode, and latency_ms.
Identified the target JSON paths as .status,.status, .errorCode, and $.latency_ms.
Metric filters for JSON logs require referencing properties using the $. notation.
2
Construct the CloudWatch Logs metric filter pattern to match failed logins.
Created the pattern `{ .status = "FAIL" && .errorCode = 401 }`.
JSON metric filters must be enclosed in curly braces and use comparison/logical operators to evaluate JSON properties.
3
Construct the CloudWatch Logs Insights query to calculate the 90th percentile of latency grouped by 15-minute intervals.
Created the query `fields @timestamp, latency_ms | filter status = "FAIL" and errorCode = 401 | stats pct(latency_ms, 90) by bin(15m)`.
CloudWatch Logs Insights queries use the pct() or percentiles() function to calculate percentiles and by bin() for grouping time intervals.

Key Concept

CloudWatch Logs Metric Filter syntax for structured JSON logs and CloudWatch Logs Insights query syntax for calculating percentiles.
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic