Question

A CloudOps engineer manages a fleet of application servers that stream structured JSON logs to a single Amazon CloudWatch Logs log group. During a recent incident, users reported intermittent slowness. The engineer needs to quickly identify, across all log streams in that log group, which API endpoints had a response time greater than 2000 ms during a specific 30-minute window, and count how many times each occurred. Which approach lets the engineer perform this analysis fastest without provisioning additional infrastructure?

Accepted Answer

Run a CloudWatch Logs Insights query on the log group that filters on the response-time field, groups by endpoint, and counts occurrences within the time range.

Answer

Create a CloudWatch metric filter for slow responses, wait for the metric to populate, then graph it on a dashboard.

Answer

Configure a subscription filter to stream the logs to an Amazon Kinesis Data Firehose delivery stream that writes to Amazon S3, then query with Amazon Athena.

Answer

Export the log group to Amazon S3 using a create-export-task, then load the objects into Amazon OpenSearch Service for ad hoc searching.