Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is configuring monitoring for a database backup process. The backup application streams JSON-formatted logs to an Amazon CloudWatch Logs group. A typical log event has the following structure:

{
"backupId": "backup-98234",
"status": "Failed",
"durationSeconds": 1450,
"database": "prod-db-01"
}

The administrator needs to monitor the duration of failed backups. Specifically, they want to create a custom CloudWatch metric that records the value of `durationSeconds` only when `status` is equal to `"Failed"`. To avoid alarm flapping and false alerts when no failures occur, the custom metric must report a value of `0` during periods with no matching log events.

Which configuration should the administrator use to achieve this?

  1. A
    Create a metric filter with the filter pattern { .status = "Failed" } and a Metric Value of .durationSeconds. Enable EC2 Detailed Monitoring on the application servers to ensure that the custom log-derived metric is updated at 1-minute intervals rather than the default 5-minute interval.
  2. B
    Create an Amazon EventBridge rule that triggers on any write to the log group. Route the event to an AWS Systems Manager Automation runbook that parses the JSON payload, extracts the durationSeconds value, and publishes it using PutMetricData with a default value of 0 when failures are absent.
  3. Create a metric filter with the filter pattern { .status = "Failed" }. Configure the metric transformation with a Metric Value of .durationSeconds and a Default Value of 0.Answer
  4. D
    Create a metric filter with the filter pattern { .status = "Failed" }. Configure the metric transformation with a Metric Value of .durationSeconds. Change the CloudWatch Logs group retention policy to "Never Expire" to prevent the custom metric's historical data points from being deleted when log events expire.

Answer

Create a metric filter with the filter pattern { .status = "Failed" }. Configure the metric transformation with a Metric Value of .durationSeconds and a Default Value of 0.
To extract a specific value from a JSON log event and publish it as a metric, you must create a metric filter with a pattern that matches the target JSON key (e.g., `{ .status = "Failed" }`). In the metric transformation configuration, specifying `.durationSeconds` as the Metric Value extracts the actual duration of the failed backup. Specifying a Default Value of `0` ensures that a value is reported to CloudWatch even when no matching log events occur, preventing the metric from reporting missing data and keeping associated alarms from entering an INSUFFICIENT_DATA state.

Step-by-Step Solution

1
Define the JSON filter pattern to match the failed backup condition.
The pattern `{ $.status = "Failed" }` matches any JSON log event where the status property equals "Failed".
This isolates the subset of log events containing the data to be measured.
2
Configure the metric value extraction settings in the metric transformation.
Set the Metric Value to `$.durationSeconds`.
This tells CloudWatch Logs to extract the numeric value of the durationSeconds key from the matched log events and use it as the metric data point.
3
Configure the default value mapping in the metric transformation.
Set the Default Value to `0`.
Setting a default value of 0 ensures that CloudWatch reports a 0 value when no events match the filter pattern, preventing the metric from reporting missing data and avoiding false alarms.

Key Concept

CloudWatch Logs Metric Filters allow extracting values from JSON-structured logs to publish custom metrics, using default values to handle periods without matching logs.
Estimated Time:1m 30s
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic