<span dir="LTR">A web application is pushing its logs to a CloudWatch Log Group. The logs are in JSON format. A log example is as below:</span>

Answer options:

A.Filter Pattern: { $.errorCode = "AccessDenied" }
Metric Value: 1
B.Filter Pattern: { $.errorCode == "AccessDenied" }
Default Value: 1
C.Filter Pattern: { errorCode == "AccessDenied" }
Metric Value: +1
D.Filter Pattern: { errorCode = "AccessDenied" }
Default Value: +1

Correct Answer : A
Option A is CORRECT because the filter pattern { $.errorCode = "AccessDenied" } can be used to check if the "errorCode" in the JSON message is "AccessDenied". Metric Value is the value published to the metric when a match occurs. So the Metric Value should be 1.
Option B is incorrect because Default Value is published to the metric when the pattern does not match. In this case, you should configure the Metric Value rather than the Default Value.
Option C is incorrect because Metric Value should be a number. The Filter Pattern is also incorrect for the JSON log events.
Option D is incorrect because it should use Metric Value instead of Default Value in order to increase the count in the CloudWatch metric.
Reference:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html