DVA-C02 Question 333
Single answerYou are a developer tasked with analyzing your application's logs in Amazon CloudWatch Logs. You need to identify the top 3 most frequently occurring error messages over the past 24 hours. Which of the following Amazon CloudWatch Logs Insights query snippets will achieve this?
- A
fields @message | filter @message like /error/ | stats count() by @message | sort count() desc | limit 3
- B
filter @message like /error/ | stats count() by @logStream | sort count() desc | limit 3
- C
fields @timestamp, @message | filter @message like /error/ | sort @timestamp desc | limit 3
- D
fields @message | filter @message like /error/ | stats avg(@timestamp) by @message | limit 3
Show answer and explanation
Correct answer: A
Explanation
The correct query snippet uses the appropriate fields and functions to filter logs for error messages, count their occurrences, sort them by frequency in descending order, and limit the results to the top 3. This aligns perfectly with the requirement to identify the most frequently occurring error messages in the logs.
- A. Correct.
This option correctly filters for error messages, counts the occurrences of each message, sorts them in descending order of frequency, and limits the output to the top 3 messages, which is the required outcome.
- B. Incorrect.
This option filters for error messages but groups the results by @logStream instead of @message, which will not provide the top 3 most frequent error messages.
- C. Incorrect.
This option filters for error messages and orders them by the timestamp, but it does not count the occurrences or sort them by frequency, so it does not meet the requirements.
- D. Incorrect.
This option filters for error messages but attempts to calculate the average timestamp. This is irrelevant to the task of identifying the most frequent error messages.