Query the log group with CloudWatch Logs Insights to count logins over seven days

DOP-C02 By islever Editorial Last updated

Audit, monitor, and analyze logs and metrics to detect issues.

Short answer

C Run a CloudWatch Logs Insights aggregation query against the log group to count the user's logins over the past seven days.

Question

A company's application runs on Amazon EC2 instances. The application writes to a log file that records the username, date, time, and source IP address of the login. The log is published to a log group in Amazon CloudWatch Logs. The company is performing a root cause analysis for an event that occurred on the previous day. The company needs to know the number of logins for a specific user from the past 7 days. Which solution will provide this information?
  1. Create a CloudWatch Logs metric filter on the log group. Use a filter pattern that matches the username. Publish a CloudWatch metric that sums the number of logins over the past 7 days.
  2. Create a CloudWatch Logs subscription on the log group. Use a filter pattern that matches the username. Publish a CloudWatch metric that sums the number of logins over the past 7 days.
  3. Create a CloudWatch Logs Insights query that uses an aggregation function to count the number of logins for the username over the past 7 days. Run the query against the log group. Correct Answer
  4. Create a CloudWatch dashboard. Add a number widget that has a filter pattern that counts the number of logins for the username over the past 7 days directly from the log group.

Key Takeaways

The investigation is retrospective and the data already exists in the log group, which is exactly the on-demand query model of CloudWatch Logs Insights (C). A metric filter (A) only creates a metric going forward and cannot retroactively count logins from the past week, which is the same objection itzrahulyadav raised. A subscription (B) streams data elsewhere rather than counting it, and a dashboard widget (D) cannot apply a filter pattern directly against a log group.

To count how many times a specific user logged in during the past seven days, run an ad-hoc CloudWatch Logs Insights query against the log group using an aggregation function that counts matching login entries for that username with a seven-day time window. Logs Insights queries the existing log data on demand, so nothing had to be configured before the event and no metric or subscription has to be maintained.

Common mistake: Creating a CloudWatch Logs metric filter to count logins (A)—metric filters only apply to data ingested after they are created, so they cannot answer a question about the previous seven days; this is exactly why itzrahulyadav rejected it. Using a subscription (B)—a subscription forwards matching events to a downstream service for processing, which is unnecessary when a single count is needed. A dashboard number widget with a filter pattern (D) cannot filter log events directly from a log group.

Expert Analysis

Why the Answer Is Correct

The requirement is an ad-hoc count over a historical window that has already passed, which is precisely the use case for CloudWatch Logs Insights: a query with an aggregation function such as count, filtered on the username, with a time predicate covering the last seven days, run against the existing log group. Because Logs Insights queries the stored log events directly and on demand, no metric or filter had to exist before the event, and no pipeline needs to be maintained afterwards.

Why the Other Options Are Wrong

A proposes a metric filter, but a metric filter only applies to log events ingested after its creation, so it cannot count activity from the preceding seven days; itzrahulyadav identified precisely this flaw. B proposes a subscription, which streams matching events to another service for processing and does not itself produce a count over historical data. D proposes a dashboard number widget, but dashboard widgets cannot apply a filter pattern directly against log events in a log group. C is the correct choice.

Community Comment Notes

Community voted C (96). Commenters noted that Logs Insights runs ad-hoc aggregation queries without additional infrastructure, and heff_bezos pointed out that no CloudWatch metric for user logins exists by default. itzrahulyadav specifically explained that a metric filter could not analyze past logs without prior setup, which is why A fails.

Official Reference

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Look for keywords like 'past,' 'historical,' or 'previous day' combined with 'count' or 'analyze.' If the data already exists in logs, choose Logs Insights because it queries stored events directly. Avoid metric filters as they require prior setup and only track new incoming logs.

Frequently Asked Questions

Why can't I use a CloudWatch metric filter for past logs?

Metric filters only process log events ingested after their creation. They cannot retroactively analyze logs from the previous 7 days.

What is CloudWatch Logs Insights used for?

It allows ad-hoc querying and aggregation of stored log data using SQL-like syntax, perfect for analyzing historical trends without pre-setup.

More DOP-C02 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. Ramdi1 👍 5 Answered C
    C - CloudWatch Logs Insights: This service allows you to run ad-hoc queries against your log data without creating additional infrastructure like metrics or subscriptions. Aggregation function: Functions like count() can specifically calculate the number of occurrences based on specific criteria. Filtering by username and timeframe: The query can be tailored to include the specific username and filter for entries within the past 7 days.
  2. kyuhuck 👍 5 Answered C
    , C. Create a CloudWatch Logs Insights query that uses an aggregation function to count the number of logins for the username over the past 7 days. Run the query against the log group. is the best solution. This method directly addresses the need to analyze log data for a specific pattern (user logins) and aggregate the counts over a specified period, which is exactly what's needed for a root cause analysis of the event.
  3. fdoxxx 👍 5 Answered C
    C is the most suitable solution for obtaining the required information
  4. mumumu 👍 4 Answered C
    The solution that will provide the number of logins for a specific user from the past 7 days is Option C: Create a CloudWatch Logs Insights query that uses an aggregation function to count the number of logins for the username over the past 7 days. Run the query against the log group.
  5. Shasha1 👍 2
    C https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_AggregationQuery.html
Show 5 more comments
  1. heff_bezos 👍 2 Answered C
    There is no cloudwatch metric that logs user logins
  2. thanhnv142 👍 1 Answered A
    A is correct: CloudWatch Logs metric filter can filter out relevant logs and count B: irrelevant, this is for sharing logs to other sources C: This can accomplish the task. However, loudWatch Logs metric filter offers us the same function with less cost. Using CloudWatch Logs Insights query incur more costs. This feature is primarily used for data analysis D: irrelevant
  3. itzrahulyadav 👍 1
    D For A you would have to setup the cloudwatch metric filters beforehand as you won't be able to analyze past logs without the setup
  4. Chelseajcole 👍 1
    C. It must be CloudWatch Logs Insights query
  5. dkp 👍 5 Answered C
    answer C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide