Question

A company runs a fleet of EC2 instances hosting a Java application that writes structured JSON application logs to local files. The DevOps team must centralize these logs in CloudWatch Logs and, without adding any code to the application, generate a custom CloudWatch metric for the number of log entries whose JSON field "level" equals "ERROR", then trigger an alarm when the error count exceeds a threshold over a 5-minute window. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Install the CloudWatch agent to ship the logs to a log group, create a metric filter on the log group using a JSON pattern that matches { $.level = "ERROR" } to publish a custom metric, and configure a CloudWatch alarm on that metric.

Answer

Modify the application to use the embedded metric format (EMF) so each ERROR log line publishes a metric, ship logs with the CloudWatch agent, and alarm on the EMF-generated metric.

Answer

Ship logs to CloudWatch Logs, schedule a CloudWatch Logs Insights query every 5 minutes via EventBridge and a Lambda function that counts ERROR entries and calls PutMetricData, then alarm on the metric.

Answer

Create a Kinesis Data Firehose subscription filter on the log group that delivers logs to Lambda, which parses each record for ERROR and publishes a custom metric, then alarm on the metric.