A video streaming service's playback API writes JSON logs to three CloudWatch Logs log groups in one Region, one per microservice. During an incident, an on-call engineer needs to see the count of each error code per hour across all three groups for the last six hours.
The engineer needs the result in the console within a minute, without moving any logs or writing a new pipeline, and the query should be reusable during the next incident. The engineer should not need to know which microservice produced an error.
Which approach meets these requirements?
Choose one answer.
AA. Export the three log groups to an S3 bucket, create an Athena table over the exported files, and run a SQL query that groups the error codes by hour.
BB. Use a Lambda function that reads the log events with the GetLogEvents API, counts the error codes in memory and prints the totals to a file the engineer can download.
CC. Select the three log groups in Logs Insights, run a query that filters errors and counts them by error code in hourly bins, and save the query.
DD. Create a metric filter for each error code in each log group, and open the metric graphs in the console, which show the counts per hour for the last six hours.
CloudWatch Logs Insights queries several log groups in place, and a query that groups and bins the results returns the hourly error counts directly in the console. Saving it lets the team reuse it. Exports, custom pipelines and metric filters that were not created in advance each add delay or work the team did not ask for.
Want more on Logs Insights, Athena and dashboards? The 5 full-length practice sets have 12 more Logs Insights, Athena and dashboards questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →