Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is configuring a monitoring solution for a microservices-based application running on Amazon EC2. The application logs are sent to Amazon CloudWatch Logs. The application outputs space-delimited log entries in the following format:

`2026-07-14T12:00:00Z WARN PaymentService 503 150`

The administrator needs to create a metric filter to monitor the frequency of HTTP 503 Service Unavailable errors generated by the PaymentService specifically, and trigger an Amazon SNS notification when this happens. What is the correct way to configure this monitoring and alerting setup?

  1. Create a CloudWatch metric filter with the pattern `[timestamp, log_level, service_name = PaymentService, status_code = 503, execution_time]`. Configure a CloudWatch alarm based on this custom metric, and set the alarm action to send a notification to the Amazon SNS topic.Answer
  2. B
    Enable detailed monitoring on the EC2 instances. Create a CloudWatch metric filter with the pattern `[timestamp, log_level, service_name = PaymentService, status_code = 503, execution_time]` to ensure that the custom metric is evaluated and published at 1-minute intervals.
  3. C
    Create a CloudWatch metric filter using the JSON pattern `{ .service_name = "PaymentService" && .status_code = 503 }`. Configure a CloudWatch alarm on the log group retention settings to notify the SNS topic when the retention period is reached.
  4. D
    Create an Amazon EventBridge rule that directly parses the EC2 space-delimited log stream pattern. Configure the rule to target an AWS Systems Manager Automation document that notifies the SNS topic and resets the log group.

Answer

Create a CloudWatch metric filter with the pattern `[timestamp, log_level, service_name = PaymentService, status_code = 503, execution_time]`. Configure a CloudWatch alarm based on this custom metric, and set the alarm action to send a notification to the Amazon SNS topic.
The correct configuration uses the standard bracket syntax `[...]` to define and filter space-delimited log entries. By listing the fields in order and using equality conditions (e.g., `service_name = PaymentService` and `status_code = 503`), CloudWatch Logs successfully isolates matching events. Once the metric is generated, a standard CloudWatch alarm can be configured to notify an Amazon SNS topic when the threshold is crossed.

Step-by-Step Solution

1
Define the space-delimited metric filter pattern using square brackets to map and inspect log fields: `[timestamp, log_level, service_name = PaymentService, status_code = 503, execution_time]`.
CloudWatch Logs extracts a custom metric whenever it encounters a log entry matching the service name and status code.
To accurately identify and count occurrences of PaymentService returning a 503 status code in space-delimited log lines.
2
Create a CloudWatch alarm based on the custom metric produced by the metric filter.
An alarm is configured to transition to the ALARM state when the custom metric exceeds a specified threshold within a given period.
To evaluate the metric value over time and prepare for an automated notification trigger.
3
Configure the CloudWatch alarm's action to send a message to an Amazon SNS topic when the alarm transitions to the ALARM state.
Subscribers to the SNS topic receive real-time notifications when the 503 error rate exceeds the threshold.
To deliver the alert to the SysOps team or automated targets.

Key Concept

CloudWatch Logs Metric Filters and Alarms
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic