Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator needs to monitor the latency of database write operations. The application outputs structured JSON log messages to an Amazon CloudWatch Logs log group. A typical log event looks like this:

{
"timestamp": "2026-07-14T15:30:00Z",
"operation": "db_write",
"status": "success",
"duration_ms": 420
}

The administrator wants to create a metric filter to publish a custom metric named `WriteDuration` to track the `duration_ms` values, but only for events where the `operation` is `"db_write"` and the `status` is `"success"`. Which configuration should the administrator use to meet these requirements?

  1. Create a CloudWatch Logs metric filter on the log group with the filter pattern `{ .operation = "db_write" && .status = "success" }` and set the Metric Value to `$.duration_ms`.Answer
  2. B
    Enable Detailed Monitoring on the Amazon EC2 instances hosting the application to expose the internal JSON logs, and configure a metric filter with the pattern `[operation = db_write, status = success]` and the Metric Value set to `$duration_ms`.
  3. C
    Configure an Amazon EventBridge rule that detects log ingestion events, target an AWS Systems Manager Automation document to parse the log lines, and publish the metric using the PutMetricData API operation.
  4. D
    Create a CloudWatch Logs metric filter with the filter pattern `{ .operation = "db_write" && .status = "success" }`, set the Metric Value to `$.duration_ms`, and change the log group retention setting to Never Expire to prevent the metric data points from being deleted.

Answer

Create a CloudWatch Logs metric filter on the log group with the filter pattern `{ .operation = "db_write" && .status = "success" }` and set the Metric Value to `$.duration_ms`.
The correct configuration uses the CloudWatch Logs metric filter with the JSON filter pattern `{ .operation = "db_write" && .status = "success" }` and sets the Metric Value to `$.duration_ms`. In CloudWatch Logs, JSON log entries are natively queried using JSONPath notation, where the dollar sign followed by a dot represents the root of the JSON object. This allows the administrator to filter for specific field values and extract the value of the duration field to publish as a metric.

Step-by-Step Solution

1
Identify the log format.
The log format is structured JSON, meaning that fields must be referenced using the `$.fieldName` notation.
Correct syntax selection is required to parse the JSON properties.
2
Formulate the filter pattern to match the criteria.
The filter pattern `{ .operation = "db_write" && .status = "success" }` is defined.
This filter pattern matches only log events where the operation is db_write and the status is success.
3
Define the Metric Value to extract the target value.
The Metric Value is set to `$.duration_ms`.
This extracts the numeric value of the duration_ms field from the matching JSON log events to publish to CloudWatch Metrics.

Key Concept

CloudWatch Logs Metric Filters allow you to extract metrics from log groups using filter patterns. For JSON logs, properties are accessed using the `$.property` notation for both matching and value extraction.
Estimated Time:1m 30s
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic