Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is setting up an Amazon CloudWatch metric filter to parse JSON logs from an application. The logs contain the following structure:

{ "request_id": "req-102", "service": "billing", "response_time_ms": 350, "status": "FAIL" }

The administrator wants to create a custom metric to track the number of failed billing requests that exceed a response time of 300300 ms. The administrator needs to record these occurrences at a 11-minute resolution in CloudWatch. Which configuration should the administrator use?

  1. A
    Define a metric filter with the pattern `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` with a metric value of ` 1 ‘,andenableDetailedMonitoringontheunderlyingloggrouptoensurea`, and enable Detailed Monitoring on the underlying log group to ensure a 1$-minute resolution.
  2. B
    Define a metric filter with the pattern `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` with a metric value of ` 1 ‘,andconfiguretheloggroupretentionperiodto`, and configure the log group retention period to 1$ day to enforce the metric reporting interval.
  3. Define a metric filter with the pattern `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` and a metric value of ` 1 ‘.Themetricfilterwillautomaticallypublishdatapointstothecustommetricata`. The metric filter will automatically publish data points to the custom metric at a 1$-minute resolution as matching events occur.Answer
  4. D
    Define a metric filter with the pattern `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` and set the filter destination directly to an AWS Systems Manager Automation document to run at a 1$-minute interval.

Answer

Define a metric filter with the pattern `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` and a metric value of ` 1 ‘.Themetricfilterwillautomaticallypublishdatapointstothecustommetricata`. The metric filter will automatically publish data points to the custom metric at a 1$-minute resolution as matching events occur.
The correct configuration uses the JSON query syntax `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` to select the target logs, incrementing the custom metric by ` 1 ‘foreachmatch.Bydefault,custommetricspublishedviametricfiltersreportdatapointsata` for each match. By default, custom metrics published via metric filters report data points at a 1$-minute resolution without requiring additional setups.

Step-by-Step Solution

1
Construct the JSON filter pattern using standard CloudWatch Logs syntax.
The pattern `{ .service = "billing" && .status = "FAIL" && .response_time_ms > 300 }` matches log entries where the service is billing, status is FAIL, and latency exceeds 300$ ms.
CloudWatch Logs parses JSON properties using the `$.property_name` notation.
2
Assign the metric value for counting occurrences.
Setting the metric value to `11` increments the count by `11` every time a matching log line is parsed.
This measures the count of events matching the error state.
3
Evaluate metric resolution and destination routing features.
CloudWatch metric filters write custom metrics at a standard 11-minute resolution by default.
No additional configuration (like Detailed Monitoring or retention adjustment) is required or valid for altering metric filter reporting frequency.

Key Concept

CloudWatch Logs Metric Filters for structured JSON logs
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic