Soru

Zorluk: OrtaMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is configuring an Amazon CloudWatch Logs subscription filter to stream logs from an application to an Amazon Kinesis Data Stream. The application logs are structured JSON documents that contain a root-level key `statusCode` and a nested object `errorInfo` with a key `severity`. The developer wants the subscription filter to select only log events where `statusCode` is 500 and `severity` is 'CRITICAL'. Which filter pattern must the developer use?

  1. { .statusCode = 500 && .errorInfo.severity = "CRITICAL" }Cevap
  2. B
    { .statusCode==500AND.statusCode == 500 AND .errorInfo.severity == "CRITICAL" }
  3. C
    fields statusCode, errorInfo.severity | filter statusCode = 500 and errorInfo.severity = "CRITICAL"
  4. D
    [statusCode = 500, errorInfo.severity = "CRITICAL"]

Cevap

The correct filter pattern is `{ .statusCode = 500 && .errorInfo.severity = "CRITICAL" }`.
The correct pattern `{ .statusCode = 500 && .errorInfo.severity = "CRITICAL" }` properly follows the CloudWatch Logs filter pattern syntax for JSON logs. It uses curly braces, dot notation for nested JSON properties, a single `=` for comparison, and `&&` for a logical AND relationship.

Adım Adım Çözüm

1
Identify the format of the log events.
The log events are structured JSON documents.
This determines that the pattern must use curly braces `{ }` and JSONPath-like notation starting with `$.`.
2
Apply the correct comparison and logical operators for CloudWatch filter patterns.
Use `=` for equality and `&&` for the logical AND operation.
CloudWatch JSON filter patterns do not use `==` or keyword operators like `AND`.
3
Construct the path to the nested property.
`$.errorInfo.severity` is used to target the `severity` field inside the nested `errorInfo` object.
JSONPath syntax allows nested fields to be traversed using dot notation.

Anahtar Kavram

CloudWatch Logs Filter Pattern Syntax for JSON Log Events
Bu soruyu puanla