Examkin

Question

Difficulty: HardCloudWatch Logs and Metric Filters

A SysOps Administrator is configuring a monitoring solution for an application that writes JSON-formatted log events to an Amazon CloudWatch Logs log group. A sample log event is shown below:

{
"eventType": "database_query",
"latency_ms": 120,
"statusCode": 500,
"clientIp": "192.0.2.1"
}

The administrator wants to track query performance by extracting the `latency_ms` value as a custom metric. If the `latency_ms` field is missing from a database query log event, the metric must record a default value of 50005000 ms. The administrator only wants to parse events where the `eventType` is equal to `"database_query"`.

Which combination of configurations must the administrator apply to meet these requirements? (Select TWO.)

  1. Create a metric filter with the filter pattern `{ $.eventType = "database_query" }`.Answer
  2. Configure the metric transformation with a metric value of `.latencyms‘andadefaultvalueof.latency_ms` and a default value of 5000$.Answer
  3. C
    Configure an Amazon EventBridge rule that detects log ingestion and triggers an AWS Systems Manager Automation runbook to parse the logs and publish custom metrics.
  4. D
    Enable detailed monitoring on the EC2 instances delivering the logs to allow the metric filter to process events at 11-minute intervals.
  5. E
    Change the log group retention settings to Never Expire so that historical logs can be evaluated for the default value calculation.

Answer

Create a metric filter with the filter pattern `{ .eventType = "database_query" }` and configure the metric transformation with a metric value of `.latency_ms` and a default value of 50005000.
To create a custom metric from JSON logs, you define a metric filter with a specific JSON property matching pattern. The pattern `{ .eventType = "database_query" }` correctly filters for the target events. The metric transformation configuration maps the metric value to the JSON property `.latency_ms`. Setting the default value to 50005000 guarantees that if the `latency_ms` field is omitted from a matched log event, CloudWatch still publishes 50005000 to the metric, satisfying the requirement for handling missing values.

Step-by-Step Solution

1
Define the JSON filter pattern to match targeted log events.
The pattern `{ $.eventType = "database_query" }` ensures only events containing this exact key-value pair are processed.
This isolates the database query logs from other application log events.
2
Configure the metric value and default value in the metric transformation.
The metric value is mapped to `.latencyms‘,andthedefaultvalueissetto.latency_ms`, and the default value is set to 5000$.
This extracts the query execution time and ensures that if the field is missing, a default timeout value of 50005000 ms is published.

Key Concept

CloudWatch Logs metric filters extract custom metrics from JSON log patterns and utilize default values to handle missing fields gracefully.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic