DVA-C02 Question 334
Single answerYou are developing a serverless application that uses Amazon CloudWatch Logs to monitor and troubleshoot your Lambda functions. You want to query the logs to identify all occurrences of the error message 'TimeoutError' and calculate the number of occurrences for each Lambda function during the last 24 hours. Which CloudWatch Logs Insights query should you use?
- A
fields @timestamp, @message | filter @message like /TimeoutError/ | stats count() by @logStream
- B
fields @timestamp, @message | filter @message like /TimeoutError/ | sort @timestamp desc
- C
fields @message | filter @message like 'TimeoutError' | stats count() by @logStream
- D
fields @message | filter @message like /TimeoutError/ | stats count() by @logGroup
Show answer and explanation
Correct answer: A
Explanation
When querying CloudWatch Logs Insights, you can use fields, filters, and aggregation functions like stats to extract insights from log data. For this scenario, the query must filter logs for 'TimeoutError', count the occurrences, and group by log stream (since each Lambda function has a separate log stream). The correct query syntax uses regex for filtering and the stats function to count by logStream.
- A. Correct.
This is the correct query. It filters log entries containing 'TimeoutError', counts the occurrences, and groups them by the log stream (each Lambda function's logs are in separate log streams).
- B. Incorrect.
This query filters for 'TimeoutError' and sorts the results by timestamp but does not count or group by log stream, which doesn't meet the requirements.
- C. Incorrect.
This query filters for 'TimeoutError' but uses an incorrect filter syntax (single quotes instead of regex slashes) and doesn't group the results correctly.
- D. Incorrect.
This query filters for 'TimeoutError' and counts occurrences, but it groups by the log group instead of the log stream, which is incorrect since logs for different Lambda functions are in separate log streams within the same log group.