What should the developer do next to meet the requirements?
Select the appropriate log group. Create a CloudWatch metric filter with “ERROR” as the search term. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
In CloudWatch Logs Insights, select the appropriate log group. Create a metric query to search for the term “ERROR” in the logs. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
Select the appropriate log group. Create an SNS subscription filter with “ERROR” as the filter pattern. Select the SNS topic as the destination.
Create a CloudWatch alarm that includes “ERROR” as a filter pattern, a log group dimension that defines the appropriate log group, and a destination that notifies the SNS topic.
Explanations:
This option correctly sets up a CloudWatch metric filter to search for the term “ERROR” in the specified log group. By creating an alarm on this metric that triggers when the metric is 1 or higher, it ensures that any occurrence of “ERROR” in the logs will result in a notification to the SNS topic, fulfilling the requirement of notifying the development team.
While this option involves using CloudWatch Logs Insights to search for “ERROR,” it does not create a persistent metric filter that can trigger alarms based on log entries. Instead, it relies on a one-time query rather than continuous monitoring, which does not meet the requirement for ongoing notifications.
This option incorrectly suggests using an SNS subscription filter with “ERROR” as the filter pattern. SNS does not support subscription filters directly for log groups. Instead, metric filters are required to convert log data into metrics that can then trigger SNS notifications, so this option does not meet the requirements.
This option suggests creating a CloudWatch alarm with “ERROR” as a filter pattern, but it does not specify the creation of a metric filter, which is necessary to track occurrences of “ERROR” in the logs. Alarms need to be based on metrics that derive from log data, so this option is incomplete and thus incorrect.