Soru

Zorluk: OrtaCloudWatch Logs and Metric Filters

A company runs a microservice application that writes JSON-formatted log events to an Amazon CloudWatch Logs group named `/aws/microservices/orders`. A SysOps Administrator needs to monitor guest checkout failures. The log events have the following structure:

{
"request_id": "req-402",
"payment_status": "DENIED",
"auth_type": "GUEST",
"amount": 250.00
}

The Administrator wants to track occurrences where the `payment_status` is `DENIED` and `auth_type` is `GUEST` by publishing a custom metric named `UnauthorizedCheckoutCount` in the `MicroserviceMonitoring` namespace. If no matching logs are processed during a reporting period, the metric must record a value of 00. Additionally, the logs must be retained for exactly 3030 days to minimize storage costs.

Which TWO actions should the SysOps Administrator take to meet these requirements? (Select TWO.)

  1. Create an Amazon CloudWatch metric filter on the log group using the filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }`, specifying a metric value of 11 and a default value of 00.Cevap
  2. Configure the retention settings of the `/aws/microservices/orders` log group to 3030 days.Cevap
  3. C
    Establish an Amazon EventBridge rule that triggers an AWS Lambda function daily to purge log streams older than 3030 days from the log group.
  4. D
    Enable detailed monitoring on the Amazon EC2 instances hosting the microservice to ensure the custom metric is populated at 11-minute intervals.
  5. E
    Configure an AWS Config rule to evaluate the log group for compliance and trigger a Systems Manager Automation runbook to publish the custom metric.

Cevap

The correct actions are: creating an Amazon CloudWatch metric filter on the log group using the filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }` (with a metric value of 11 and a default value of 00), and configuring the retention settings of the log group to 3030 days.
The correct options state that the Administrator should create a metric filter on the log group using the filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }` (with a metric value of 11 and default value of 00), and change the retention settings of the log group to 3030 days. This combines the correct JSON selector syntax for filters, configures the metric to publish a 00 value when logs are absent, and natively manages log lifecycle.

Adım Adım Çözüm

1
Parse JSON properties using the correct CloudWatch Logs filter pattern syntax.
The filter pattern `{ (.payment_status = "DENIED") && (.auth_type = "GUEST") }` is configured to target matching logs.
This syntax correctly targets JSON fields, applying boolean matching on log event elements.
2
Set the metric value and default value in the metric filter configuration.
Metric value is set to 11 to count events, and default value is set to 00.
Setting the default value to 00 ensures that CloudWatch records data points during time intervals where no logs match the filter criteria.
3
Configure the native log group retention setting.
The `/aws/microservices/orders` log group retention is modified from 'Never expire' to '3030 days'.
This is the native, low-overhead method to delete logs after the specified storage duration.

Anahtar Kavram

CloudWatch Logs JSON Metric Filters and Native Log Group Retention
Tahmini Süre:2m 0s
Bu soruyu puanla