Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is configuring an Amazon CloudWatch metric filter to parse custom application log events written to an Amazon CloudWatch Logs log group named `/apps/payment-service`. The application logs events in the following JSON format:

{
"request_id": "req-98213",
"operation": "ProcessPayment",
"response_code": 500,
"execution_time_ms": 450,
"client_details": {
"tier": "Premium",
"region": "us-east-1"
}
}

The Administrator wants to monitor when `ProcessPayment` operations for `Premium` tier clients fail with a `response_code` of 500 or higher, and record the `execution_time_ms` value as a custom metric.

Which two configurations must the Administrator apply to the metric filter and its metric transformation to accomplish this? (Select TWO.)

  1. Use `{ .operation = "ProcessPayment" && .client_details.tier = "Premium" && $.response_code >= 500 }` as the filter pattern.Answer
  2. Set the Metric Value in the metric transformation to `$.execution_time_ms`.Answer
  3. C
    Use `[operation = "ProcessPayment", client_details.tier = "Premium", response_code >= 500]` as the filter pattern.
  4. D
    Enable detailed monitoring on the EC2 instances hosting the application to ensure that the custom metric publishes data at 1-minute intervals.
  5. E
    Configure an Amazon EventBridge rule to match the log patterns and invoke an AWS Systems Manager Automation document to extract the custom metric values.

Answer

Use the JSON filter pattern with curly braces and reference the field path `$.execution_time_ms` in the Metric Value field of the metric transformation.
To filter JSON logs in CloudWatch Logs, the filter pattern must use curly braces `{}` and specify paths using the JSON path notation (such as `.operation`). The pattern evaluates matching logs by utilizing comparison operators like `=` and `>=` joined by logical operators like `&&`. To publish a specific value from the log event (such as `execution_time_ms`) rather than a simple count of occurrences, the Metric Value in the metric transformation must reference the JSON path of that value, which is `.execution_time_ms`.

Step-by-Step Solution

1
Analyze the log format to identify how to reference the target fields.
The log is in JSON format, meaning JSON path notation (starting with `$.`) must be used inside curly braces `{}` to filter events.
CloudWatch Logs requires JSON path syntax for JSON logs, and space-delimited/bracketed syntax for standard text logs.
2
Formulate the filter pattern to match the criteria: operation is 'ProcessPayment', client tier is 'Premium', and response code is 500 or higher.
The correct pattern is `{ .operation = "ProcessPayment" && .client_details.tier = "Premium" && $.response_code >= 500 }`.
This pattern uses correct logical operators and property paths (including nested property `client_details.tier`).
3
Configure the metric value extractor in the metric transformation.
Set the Metric Value to `$.execution_time_ms`.
Using the JSON path references the numeric value of the field to publish it as the metric measurement instead of incrementing a simple counter.

Key Concept

Filtering JSON logs and extracting metric values using CloudWatch Metric Filters
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic