Query the log group with CloudWatch Logs Insights to count logins over seven days

Audit, monitor, and analyze logs and metrics to detect issues.

Answer Correct answer: C — run a CloudWatch Logs Insights aggregation query against the log group to count the user's logins over the past seven days.

A company's application runs on Amazon EC2 instances. The application writes to a log file that records the username, date, time, and source IP address of the login. The log is published to a log group in Amazon CloudWatch Logs. The company is performing a root cause analysis for an event that occurred on the previous day. The company needs to know the number of logins for a specific user from the past 7 days. Which solution will provide this information?

Create a CloudWatch Logs metric filter on the log group. Use a filter pattern that matches the username. Publish a CloudWatch metric that sums the number of logins over the past 7 days.
Create a CloudWatch Logs subscription on the log group. Use a filter pattern that matches the username. Publish a CloudWatch metric that sums the number of logins over the past 7 days.
Create a CloudWatch Logs Insights query that uses an aggregation function to count the number of logins for the username over the past 7 days. Run the query against the log group. Correct Answer
Create a CloudWatch dashboard. Add a number widget that has a filter pattern that counts the number of logins for the username over the past 7 days directly from the log group.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The investigation is retrospective and the data already exists in the log group, which is exactly the on-demand query model of CloudWatch Logs Insights (C). A metric filter (A) only creates a metric going forward and cannot retroactively count logins from the past week, which is the same objection itzrahulyadav raised. A subscription (B) streams data elsewhere rather than counting it, and a dashboard widget (D) cannot apply a filter pattern directly against a log group.

To count how many times a specific user logged in during the past seven days, run an ad-hoc CloudWatch Logs Insights query against the log group using an aggregation function that counts matching login entries for that username with a seven-day time window. Logs Insights queries the existing log data on demand, so nothing had to be configured before the event and no metric or subscription has to be maintained.

Creating a CloudWatch Logs metric filter to count logins (A)—metric filters only apply to data ingested after they are created, so they cannot answer a question about the previous seven days; this is exactly why itzrahulyadav rejected it. Using a subscription (B)—a subscription forwards matching events to a downstream service for processing, which is unnecessary when a single count is needed. A dashboard number widget with a filter pattern (D) cannot filter log events directly from a log group.

Community Discussion (10 comments)

Ramdi1 👍 5 Selected: C

C - CloudWatch Logs Insights: This service allows you to run ad-hoc queries against your log data without creating additional infrastructure like metrics or subscriptions. Aggregation function: Functions like count() can specifically calculate the number of occurrences based on specific criteria. Filtering by username and timeframe: The query can be tailored to include the specific username and filter for entries within the past 7 days.

dkp 👍 5 Selected: C

answer C

heff_bezos 👍 2 Selected: C

There is no cloudwatch metric that logs user logins

itzrahulyadav 👍 1

D For A you would have to setup the cloudwatch metric filters beforehand as you won't be able to analyze past logs without the setup

mumumu 👍 4 Selected: C

The solution that will provide the number of logins for a specific user from the past 7 days is Option C: Create a CloudWatch Logs Insights query that uses an aggregation function to count the number of logins for the username over the past 7 days. Run the query against the log group.

Shasha1 👍 2

C https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_AggregationQuery.html

fdoxxx 👍 5 Selected: C

C is the most suitable solution for obtaining the required information

kyuhuck 👍 5 Selected: C

, C. Create a CloudWatch Logs Insights query that uses an aggregation function to count the number of logins for the username over the past 7 days. Run the query against the log group. is the best solution. This method directly addresses the need to analyze log data for a specific pattern (user logins) and aggregate the counts over a specified period, which is exactly what's needed for a root cause analysis of the event.

thanhnv142 👍 1 Selected: A

A is correct: CloudWatch Logs metric filter can filter out relevant logs and count B: irrelevant, this is for sharing logs to other sources C: This can accomplish the task. However, loudWatch Logs metric filter offers us the same function with less cost. Using CloudWatch Logs Insights query incur more costs. This feature is primarily used for data analysis D: irrelevant

Chelseajcole 👍 1

C. It must be CloudWatch Logs Insights query

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The requirement is an ad-hoc count over a historical window that has already passed, which is precisely the use case for CloudWatch Logs Insights: a query with an aggregation function such as count, filtered on the username, with a time predicate covering the last seven days, run against the existing log group. Because Logs Insights queries the stored log events directly and on demand, no metric or filter had to exist before the event, and no pipeline needs to be maintained afterwards.

Why the Other Options Are Wrong

A proposes a metric filter, but a metric filter only applies to log events ingested after its creation, so it cannot count activity from the preceding seven days; itzrahulyadav identified precisely this flaw. B proposes a subscription, which streams matching events to another service for processing and does not itself produce a count over historical data. D proposes a dashboard number widget, but dashboard widgets cannot apply a filter pattern directly against log events in a log group. C is the correct choice.

Community Comment Notes

Community voted C (96). Commenters noted that Logs Insights runs ad-hoc aggregation queries without additional infrastructure, and heff_bezos pointed out that no CloudWatch metric for user logins exists by default. itzrahulyadav specifically explained that a metric filter could not analyze past logs without prior setup, which is why A fails.

Official Reference

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html

Related Analysis

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide