Examkin

Question

Difficulty: HardCloudWatch Logs and Metric Filters

A SysOps Administrator is monitoring a web application hosted on Amazon EC2 instances. The application writes structured JSON logs to an Amazon CloudWatch Logs log group. A representative log event is shown below:

{
"environment": "production",
"http_details": {
"status_code": 502,
"duration_ms": 420
}
}

The Administrator needs to create a custom metric named `BackendLatency` in the `App/Monitoring` namespace. This metric must record the `duration_ms` value only for production environment requests that result in an HTTP 5xx server error (status code 500500 to 599599). Additionally, if the latency exceeds 500500 ms, the Administrator wants to trigger an automated workflow to restart the application service on the EC2 instances. Which configuration should the Administrator implement to meet these requirements?

  1. Create a CloudWatch Logs metric filter with the filter pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` and set the metric value to `.http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and configure an Amazon EventBridge rule that reacts to the alarm state change to trigger an AWS Systems Manager Automation document.Answer
  2. B
    Create a CloudWatch Logs metric filter with the filter pattern `{ (.environment = "production") && (.http_details.status_code = 5*) }` and set the metric value to `$.http_details.duration_ms`. Configure the metric filter's metric transformation properties to directly execute an AWS Systems Manager Automation document when a matching log event is detected.
  3. C
    Enable detailed monitoring on the EC2 instances to allow CloudWatch Logs to process custom metrics at 1-minute granularity. Create a metric filter with the filter pattern `{ (.environment = "production") && (.http_details.status_code = 5??) }` and set the metric value to `$.http_details.duration_ms`. Configure a CloudWatch alarm to trigger an Auto Scaling policy to replace the instances.
  4. D
    Create a CloudWatch Logs metric filter with the filter pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` and set the metric value to `.http_details.duration_ms`. Set the log group retention period to 14 days within the metric filter configuration to control storage costs, and configure a custom AWS Config rule to monitor the metric's alarm state and trigger the service restart.

Answer

Create a CloudWatch Logs metric filter using the pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` and set the metric value to `.http_details.duration_ms`. Create a CloudWatch alarm based on this metric, and use an Amazon EventBridge rule triggered by the alarm state change to run an AWS Systems Manager Automation document that restarts the service.
The correct option correctly uses JSON comparison operators (`>= 500` and `< 600`) to capture the numeric 5xx status codes, extracts the correct nested property (`$.http_details.duration_ms`) as the metric value, and uses a standard CloudWatch alarm coupled with an Amazon EventBridge rule to execute the Systems Manager Automation document. This properly decouples log metric extraction from resource remediation.

Step-by-Step Solution

1
Define the CloudWatch Logs metric filter pattern to match JSON structure and numeric ranges.
The pattern `{ (.environment = "production") && (.http_details.status_code >= 500) && (.http_details.status_code < 600) }` is configured. This matches events where the status code is a number between 500 and and 599$ inclusive, and the environment is 'production'.
CloudWatch Logs JSON metric filters require explicit comparison operators for numeric fields. Wildcards are only supported for string values.
2
Specify the metric value to extract from the log event structure.
The metric value is set to `$.http_details.duration_ms`.
This extracts the value of the duration_ms field from the matched log events to populate the metric data points.
3
Configure the automated remediation trigger workflow.
A CloudWatch alarm is created on the custom metric. An Amazon EventBridge rule is set up to listen for the alarm state transition to ALARM and targets an AWS Systems Manager Automation document to perform the restart.
Metric filters themselves cannot perform remediation actions. CloudWatch alarms must be paired with EventBridge or SNS to invoke automation tools like Systems Manager.

Key Concept

CloudWatch Logs JSON metric filters require numeric range operators rather than wildcards, and automation must flow from alarms via EventBridge or SNS rather than directly from metric filters.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic