Question

A CloudOps engineer manages a fleet of application servers that write logs to a CloudWatch Logs log group. The application writes a log line containing the string "PaymentDeclined" whenever a transaction fails. The business wants to be notified via an SNS topic whenever more than 10 payment declines occur within any 5-minute period, and they want to visualize the decline count over time on a dashboard. Which approach meets these requirements with the least custom code?

Accepted Answer

Create a CloudWatch Logs metric filter that matches "PaymentDeclined" and publishes a custom metric, then create a CloudWatch alarm on that metric with a threshold of 10 over a 5-minute period targeting the SNS topic, and add the metric to a dashboard.

Answer

Create a CloudWatch Logs subscription filter that streams all log events to a Lambda function which counts occurrences and calls the SNS Publish API when the count exceeds 10.

Answer

Enable CloudWatch anomaly detection on the log group and configure an anomaly detection alarm to notify the SNS topic when decline counts deviate from the expected band.

Answer

Create an EventBridge rule that matches "PaymentDeclined" log events and routes them to an SNS topic, then build a QuickSight dashboard from the log data.