DVA-C02 Question 332
Single answerYou are developing a serverless application that logs all API requests to Amazon CloudWatch Logs. You want to analyze the logs to identify the top 3 most frequently accessed API endpoints in the last 24 hours. Which of the following Amazon CloudWatch Logs Insights query would help you achieve this?
- A
fields @timestamp, @message | sort @timestamp desc | limit 3
- B
filter @message like /API/ | stats count() by @message | sort count desc | limit 3
- C
stats count(@message) as messageCount | sort messageCount desc | limit 3
- D
filter @message like /API/ | stats count(@requestPath) as endpointCount by @requestPath | sort endpointCount desc | limit 3
Show answer and explanation
Correct answer: D
Explanation
Amazon CloudWatch Logs Insights is used to query and analyze log data effectively. The correct query filters relevant log data (e.g., messages containing 'API'), groups by the API endpoint field (@requestPath), counts occurrences, and sorts by count in descending order to identify the most frequently accessed endpoints. This approach is efficient and meets the requirement to analyze the top 3 accessed API endpoints in the last 24 hours.
- A. Incorrect.
This query sorts logs by timestamp in descending order and limits the output to 3 entries, but it does not analyze or count the API endpoints or filter the logs by relevant fields.
- B. Incorrect.
This query filters messages containing the keyword 'API' and counts occurrences of entire log messages. However, it does not specifically analyze or group by the API endpoint field (e.g., @requestPath).
- C. Incorrect.
This query attempts to count all log messages without grouping or filtering by API endpoints, and therefore does not provide the top accessed API endpoints.
- D. Correct.
This query filters logs for messages containing 'API', counts occurrences of each API endpoint (grouped by @requestPath), sorts them in descending order by count, and limits the result to the top 3. This matches the requirement exactly.