Examkin

Question

Difficulty: MediumCloudWatch Logs and Metric Filters

A SysOps Administrator is monitoring a message-processing application that publishes execution logs to an Amazon CloudWatch Logs group. The log events are formatted in JSON as shown in the following example:

{
"queue": "task-worker",
"msg_id": "m-9941",
"duration": 6.2,
"status": "DLQ_REDIRECT"
}

The Administrator wants to extract the message processing duration as a custom CloudWatch metric named `DLQProcessingTime` under the namespace `CustomWorker`, but only for messages that are redirected to the dead-letter queue where the `status` field equals `"DLQ_REDIRECT"`.

Which TWO configuration steps must the Administrator perform to extract this metric?

  1. Create a CloudWatch Logs metric filter with the filter pattern { $.status = "DLQ_REDIRECT" }.Answer
  2. Configure the metric transformation with a Metric Value of $.duration and Namespace of CustomWorker.Answer
  3. C
    Set the log retention period of the CloudWatch Logs group to 14 days to enable metric extraction on JSON log streams.
  4. D
    Enable CloudWatch detailed monitoring on the application servers to allow log extraction at 1-minute intervals.
  5. E
    Create an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to parse the log group stream.

Answer

The SysOps Administrator must create a CloudWatch Logs metric filter using the JSON filter pattern { .status = "DLQ_REDIRECT" } and configure the metric transformation with a Metric Value of .duration and Namespace of CustomWorker.
To extract a metric from JSON logs, two actions are required: defining the filter pattern to match the target log events and setting up the metric transformation to specify where the metric value comes from. The filter pattern `{ .status = "DLQ_REDIRECT" }` correctly matches only the subset of events that have been redirected. The metric transformation mapping the value to `.duration` successfully extracts the execution duration variable and registers it in the `CustomWorker` namespace.

Step-by-Step Solution

1
Define a filter pattern to match JSON fields.
Created a filter pattern `{ $.status = "DLQ_REDIRECT" }` that evaluates only logs where the JSON property `status` is equal to the specified string.
This filter filters out unrelated logs so that the metric is only calculated from events redirected to the dead-letter queue.
2
Define the metric transformation rules.
Configured the metric transformation mapping `DLQProcessingTime` as the metric name, `CustomWorker` as the namespace, and `$.duration` as the metric value source.
The metric value source tells CloudWatch Logs which numeric field in the JSON structure represents the metric value to publish.

Key Concept

CloudWatch Logs Metric Filters with JSON Log Data
Estimated Time:1m 30s
Rate this question

Topics

CloudWatch Logs and Metric Filters

More questions from this topic