Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is configuring a monitoring solution for a batch-processing application. The application logs are published to an Amazon CloudWatch Logs log group. The logs are formatted as space-delimited text, with each line containing the following fields in order: date, time, transaction ID, status code, and processing time in milliseconds.

An example log line is:
`2026-07-14 17:30:56 TXN-99482 502 120`

The Administrator needs to create a CloudWatch metric filter to extract the processing time as a metric, but only for transactions that resulted in a server error (status codes 500 through 599). The metric must report a value of 0 when no matching log events are found during a reporting period.

Which TWO configurations should the Administrator apply to meet these requirements? (Select TWO.)

  1. Use `[date, time, txn_id, status_code >= 500 && status_code <= 599, processing_time]` as the filter pattern.Answer
  2. In the metric transformation, set the metric value to `$processing_time` and set the default value to `0`.Answer
  3. C
    In the metric transformation settings, set the log group retention period to 0 days to delete non-matching log events and reduce storage costs.
  4. D
    Enable detailed monitoring on the metric filter to ensure the custom metric reports data at 1-minute intervals instead of the default 5-minute intervals.
  5. E
    Configure an Amazon EventBridge rule triggered by a Systems Manager Automation document to reset the custom metric value to 0 when no log events are ingested.

Answer

Use a space-delimited filter pattern of `[date, time, txn_id, status_code >= 500 && status_code <= 599, processing_time]` and configure the metric transformation with a metric value of `$processing_time` and a default value of `0`.
The correct configurations involve using bracket syntax for space-delimited text logs to isolate the status code using numerical operators (`status_code >= 500 && status_code <= 599`), and setting up the metric transformation with `$processing_time` as the metric value along with `0` as the default value to guarantee metric publishing during quiet periods.

Step-by-Step Solution

1
Define the space-delimited log filter pattern.
The pattern `[date, time, txn_id, status_code >= 500 && status_code <= 599, processing_time]` correctly identifies the columns in order and applies a numerical range comparison on the status_code field.
This filters the log streams to target only those events where the status code is a 5xx server error.
2
Configure the metric value and default value in the metric transformation.
Setting the metric value to `$processing_time` extracts the numerical value of that field, and setting the default value to `0` ensures the metric is published even when there are no matching events.
This meets the requirement of capturing the processing duration as the metric value and handling periods of zero matching traffic.

Key Concept

CloudWatch Logs Metric Filters allow developers and SysOps administrators to extract custom metrics from log data using filters and transformations. For space-delimited logs, bracket syntax is used to name columns and perform conditional matches. Metric transformations map these matched fields to custom metrics and handle missing data with default values.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic