Question

A CloudOps engineer manages a fleet of EC2 instances running a custom Java application that writes JSON-formatted application logs to /var/log/app/events.log. The team wants these logs centralized in CloudWatch Logs and needs to create a metric filter that counts log events where the JSON field "level" equals "ERROR". Currently no logs are being collected from the instances. What is the correct sequence of actions to achieve this?

Accepted Answer

Install and configure the CloudWatch agent to stream /var/log/app/events.log to a log group, then create a metric filter using a JSON filter pattern like { $.level = "ERROR" } and set an alarm on the resulting metric.

Answer

Enable EC2 detailed monitoring, which automatically ingests application log files, then create a subscription filter to count ERROR events.

Answer

Configure a CloudWatch dashboard to read the log file directly from the instance, then add a text-based filter widget matching "ERROR".

Answer

Install the CloudWatch agent to collect the logs, then use CloudWatch Logs Insights on a schedule to create a metric because metric filters cannot parse JSON fields.