Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is configuring a monitoring solution for a new microservice that writes JSON-formatted application logs to an Amazon CloudWatch Logs group. A typical log entry has the following structure:

{
"timestamp": "2026-07-15T12:00:00Z",
"level": "ERROR",
"event": {
"service": "database-connector",
"error_code": 504,
"message": "Connection timed out after 10000ms"
}
}

The administrator wants to increment a custom CloudWatch metric whenever the `service` value is "database-connector" and the `error_code` is 504. Which configuration will achieve this requirement?

  1. Create a CloudWatch Logs metric filter with the filter pattern `{ .event.service = "database-connector" && .event.error_code = 504 }` and associate it with a metric transformation.Answer
  2. B
    Create an Amazon EventBridge rule that intercepts the CloudWatch log group events and triggers an AWS Systems Manager Automation document to parse the JSON log stream and increment the custom metric.
  3. C
    Enable detailed monitoring on the EC2 instances hosting the microservice, which automatically configures CloudWatch to parse the application logs for error events and generate the metric at 1-minute intervals.
  4. D
    Configure a log retention policy on the CloudWatch log group to aggregate log events hourly and publish them to an Amazon S3 bucket for metric transformation.

Answer

Create a CloudWatch Logs metric filter with the filter pattern `{ .event.service = "database-connector" && .event.error_code = 504 }` and associate it with a metric transformation.
The correct answer is the configuration that creates a CloudWatch Logs metric filter with the filter pattern `{ .event.service = "database-connector" && .event.error_code = 504 }` and associates it with a metric transformation. CloudWatch Logs natively supports parsing JSON log entries. By using dot notation (e.g., `$.event.service`), you can reference nested keys, and the single equals sign (`=`) is the standard comparison operator within JSON filter pattern syntax.

Step-by-Step Solution

1
Parse the JSON structure in the log event to identify the path to the required fields.
The target fields are nested inside the 'event' object: 'service' is at '.event.service′and′errorcode′isat′.event.service' and 'error_code' is at '.event.error_code'.
CloudWatch Logs JSON metric filters require specifying the full path using dot notation to target nested fields.
2
Use the correct CloudWatch Logs JSON filter pattern syntax to construct the query.
The query is enclosed in curly braces '{ }' and uses standard comparison operators like '=' for matching values, combined with the '&&' logical operator.
CloudWatch Logs metric filters use a single '=' for string and numeric comparisons in JSON documents.
3
Configure the metric filter with the pattern and define a metric transformation.
A metric filter is successfully established on the log group, pointing to a metric transformation that increments the custom metric count by 1.
The metric transformation maps the filtered pattern matches to a custom CloudWatch metric namespace and name.

Key Concept

Filtering JSON-formatted logs using CloudWatch metric filters and dot notation
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic