Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

An organization's legacy web application streams its access logs to an Amazon CloudWatch Logs group named `/apps/web-server/access_log` in the following Common Log Format (CLF):

192.0.2.10 - - [14/Jul/2026:10:15:30 +0000] "POST /api/v1/payment HTTP/1.1" 401 1024

A SysOps Administrator needs to create a custom metric to count HTTP 401401 unauthorized access attempts to the `/api/v1/payment` endpoint. If the rate of these attempts exceeds 1010 per minute, an automated remediation workflow must be triggered. Which configuration and architecture should the SysOps Administrator implement to meet these requirements?

  1. Create a metric filter on the log group with the pattern `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]` to publish a custom metric, and configure a CloudWatch alarm on this metric to trigger an Amazon EventBridge rule.Answer
  2. B
    Enable CloudWatch Detailed Monitoring on the underlying web servers to decrease log processing latency to 11-minute, and configure a metric filter using the JSON pattern `{ .request = "*payment*" && .status_code = 401 }`.
  3. C
    Configure a metric filter using the pattern `[ip, identity, user, timestamp, request = "%payment%", status_code = 401, size]`, and set the log group retention period to at least 3030 days to preserve the metric data.
  4. D
    Create an Amazon EventBridge rule with an event pattern matching the log group directly using `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]` to route matching logs directly to an AWS Systems Manager Automation document.

Answer

Create a metric filter on the log group with the pattern `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]` to publish a custom metric, and configure a CloudWatch alarm on this metric to trigger an Amazon EventBridge rule.
The correct option correctly uses the space-delimited array syntax to define the fields in the Common Log Format (CLF). It filters the fifth field (request) using wildcard asterisks to match requests containing the word 'payment', and filters the sixth field (status_code) to match HTTP 401. It then publishes this count as a custom metric, which is monitored by a CloudWatch alarm that triggers an EventBridge rule for remediation.

Step-by-Step Solution

1
Analyze the log format to identify how fields are delimited.
The log format is space-delimited (Common Log Format), which requires a space-delimited filter pattern `[field1, field2, ...]` where fields containing spaces (like request) are grouped by quotes.
Choosing the correct filter syntax ensures CloudWatch Logs can parse the fields correctly.
2
Define the filter pattern rules using wildcard operators and status code filters.
The filter pattern is defined as `[ip, identity, user, timestamp, request = "*payment*", status_code = 401, size]`, using asterisks (`*`) as wildcards.
This isolates HTTP 401401 status codes for requests containing '/payment'.
3
Connect the custom metric to an alarm and remediation action.
Create a CloudWatch alarm based on the custom metric published by the filter and configure it to notify an Amazon EventBridge rule when the threshold of 1010 attempts per minute is breached.
This establishes the automated remediation workflow.

Key Concept

CloudWatch Logs Metric Filters allow you to parse space-delimited or JSON log entries to publish custom metrics, which can then trigger alarms and automated remediation via EventBridge.
Estimated Time:1m 30s
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic