Examkin

Question

Difficulty: EasyCloudWatch Logs and Metric Filters

A SysOps Administrator is monitoring a third-party payment processing helper utility that writes space-delimited transaction logs to Amazon CloudWatch Logs. The format of the log entries is:

`[timestamp, transaction_id, status_code, latency_ms, response_size]`

An example log entry is:

`2026-07-14T12:00:00Z tx-9988 502 350 1024`

The administrator wants to extract the `latency_ms` value into a custom metric for any transaction where the `status_code` is 500500 or higher.

Which TWO steps are required to correctly configure this monitoring solution? (Select TWO.)

  1. Set the Filter Pattern to `[timestamp, transaction_id, status_code >= 500, latency_ms, response_size]`.Answer
  2. Set the Metric Value to `$latency_ms` in the metric transformation configuration.Answer
  3. C
    Enable detailed monitoring on the CloudWatch log group to decrease the custom metric reporting interval to 11 minute.
  4. D
    Configure a CloudWatch Logs subscription filter to route the raw logs directly to an Amazon EventBridge event bus to trigger remediation.
  5. E
    Adjust the log retention setting of the log group to 11 day to ensure that metric filter calculations are processed before log data expires.

Answer

Setting the Filter Pattern to `[timestamp, transaction_id, status_code >= 500, latency_ms, response_size]` and setting the Metric Value to `$latency_ms` in the metric transformation configuration.
To extract latency data for server errors from a space-delimited log, the administrator must define the correct field mapping in the filter pattern and use a relational operator (`status_code >= 500`). The administrator must also configure the metric transformation to extract the specific value by referencing the field name with a dollar sign (`$latency_ms`).

Step-by-Step Solution

1
Identify the correct space-delimited filter pattern syntax to filter log entries based on a specific field condition.
The pattern `[timestamp, transaction_id, status_code >= 500, latency_ms, response_size]` is constructed.
For space-delimited logs, fields are listed in brackets, and conditional expressions like `>= 500` are applied directly to the field name.
2
Specify the value to be extracted and recorded in the custom metric.
The metric value is set to `$latency_ms`.
Referencing a field value in a metric transformation requires prefixing the field name with a dollar sign (`$`).
3
Verify that the other options represent invalid or unrelated configurations.
Detailed monitoring, subscription filters to EventBridge, and log retention changes are discarded.
Detailed monitoring applies to EC2 instances, subscription filters do not target EventBridge directly, and log retention is for storage duration, not real-time log ingestion processing.

Key Concept

CloudWatch Logs Metric Filters allow SysOps administrators to search and filter log data, and extract values from space-delimited or JSON log entries to create custom metrics in real-time.
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic