DVA-C03 practice question: Logging and CloudWatch Logs Insights (1 of 3)
Troubleshooting and Optimization A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A payments Lambda function writes plain-text log lines such as 'charge failed errorCode=CardDeclined orderId=8841'.
The developer wants, in CloudWatch Logs Insights, the number of failures for each errorCode over the time range selected in the console, with the most frequent codes first. The function writes these lines for every payment, and the team reviews the counts each week.
BB. parse @message "errorCode=* *" as code, rest | stats count(*) by code | sort count(*) desc | limit 20
CC. filter @message like /errorCode/ | sort @timestamp asc | fields @message | limit 20
DD. filter @message like /errorCode/ | stats count(*) by bin(24h) | sort count(*) desc | limit 20
Show the answer and explanation
Answer: B
A. Wrong: Grouping by @message counts each distinct line, and each line has a different orderId. The counts would not show totals for each error code.
B. Right: Correct. parse extracts the text after errorCode= into a field named code, using a glob in which each * becomes a named field. stats then counts the lines for each code, and sort puts the most frequent codes first. Learn more: parse - Amazon CloudWatch Logs (opens in a new tab)
C. Wrong: This lists matching lines in time order. It does not count failures or group them by error code.
D. Wrong: bin(24h) groups the counts by day, so it shows how many failures there were, but not how they split by error code.
Explanation
The parse command extracts parts of a plain-text line with a glob pattern, and each * becomes an alias. Grouping with stats and sorting by count then shows the most frequent error codes. The 24-hour window comes from the console's time range, not from the query.
Want more on Logging and CloudWatch Logs Insights? The 5 full-length practice sets have 11 more Logging and CloudWatch Logs Insights questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →