What should the developer do next to meet the requirements?
Select the appropriate log group. Create a CloudWatch metric filter with “ERROR” as the search term. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
In CloudWatch Logs Insights, select the appropriate log group. Create a metric query to search for the term “ERROR” in the logs. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
Select the appropriate log group. Create an SNS subscription filter with “ERROR” as the filter pattern. Select the SNS topic as the destination.
Create a CloudWatch alarm that includes “ERROR” as a filter pattern, a log group dimension that defines the appropriate log group, and a destination that notifies the SNS topic.
Explanations:
This option describes creating a CloudWatch metric filter that searches for the term “ERROR” in the specified log group. By setting an alarm on this metric to notify the SNS topic when the count is 1 or higher, the development team will receive notifications whenever an “ERROR” appears in the logs. This meets the requirement effectively.
While this option mentions using CloudWatch Logs Insights to create a metric query for the term “ERROR,” it does not establish a direct link to generate an alarm based on the occurrence of this term in real-time. The query is useful for ad-hoc analysis but does not create an ongoing monitoring solution for notifications.
This option incorrectly suggests using an SNS subscription filter with the term “ERROR.” However, SNS does not directly subscribe to log groups or perform filtering on log contents. Metric filters are needed to extract log data and trigger notifications based on specific terms like “ERROR.”
This option describes creating a CloudWatch alarm with “ERROR” as a filter pattern but does not specify the proper configuration of a metric filter needed for this use case. The alarm would not function correctly without an underlying metric filter that counts occurrences of “ERROR” in the log group, making this option incomplete.