Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is monitoring an enterprise file synchronization agent that outputs space-delimited log entries to Amazon CloudWatch Logs. The log entries are formatted as follows:

`[Date] [Time] [AgentID] [SyncStatus] [DurationMs] [FilesSynced]`

An example log entry is:

`2026-07-14 17:30:00 AGENT-402 SUCCESS 1250 45`

The administrator needs to configure a CloudWatch metric filter to track the total number of files synced across all agents, but only for sync operations that completed successfully.

Which configuration will meet these requirements?

  1. Create a metric filter with the filter pattern `[date, time, agent_id, status = SUCCESS, duration, files_synced]` and set the metric value to `$files_synced`.Answer
  2. B
    Create a metric filter with the filter pattern `[date, time, agent_id, status = SUCCESS, duration, files_synced]` and set the metric value to `1`.
  3. C
    Create a metric filter with the filter pattern `[date, time, agent_id, status = SUCCESS, duration, files_synced]`, set the metric value to `$files_synced`, and set the log group retention period to 1 day to limit metric processing to current data.
  4. D
    Enable detailed monitoring on the host servers, then create a metric filter with the JSON pattern `{ .status = "SUCCESS" }` and set the metric value to `.files_synced`.

Answer

Create a metric filter with the filter pattern `[date, time, agent_id, status = SUCCESS, duration, files_synced]` and set the metric value to `$files_synced`.
The correct configuration uses the space-delimited pattern syntax `[date, time, agent_id, status = SUCCESS, duration, files_synced]`. Since the log entries are space-delimited, mapping them sequentially in brackets allows the metric filter to parse each field. Specifying `status = SUCCESS` filters the log events. Setting the metric value to `$files_synced` ensures that the numeric value in the sixth field is published to the custom CloudWatch metric, allowing CloudWatch to aggregate the total number of files synced.

Step-by-Step Solution

1
Analyze the log format and identify the filter pattern style.
The log format is space-delimited text. The metric filter pattern must use bracket syntax `[...]` to define the fields in sequential order.
Since the log is not in JSON format, JSON path querying cannot be used. Space-delimited logs require positional mapping of fields within brackets.
2
Formulate the filter pattern matching condition.
Map the fields: `[date, time, agent_id, status = SUCCESS, duration, files_synced]`. This filters events where the fourth field (status) is exactly SUCCESS.
We must only count files from sync operations that completed successfully, so we filter by status.
3
Determine the metric value assignment.
Assign `$files_synced` as the metric value.
To track the total number of files synced rather than just the number of sync occurrences, the metric filter must extract the numeric value from the sixth field, which is referenced as `$files_synced`.

Key Concept

CloudWatch Logs Metric Filters parse log data using pattern matching for space-delimited or JSON events and publish custom metrics based on extracted values.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic