Create a Contributor Insights rule for top contributors and alarm on INSIGHT_RULE_METRIC for over half the errors

Why the Answer Is Correct

The requirement is to be alerted when any single EC2 instance is responsible for more than half of all errors, and the logs are already collected in the embedded metric format, which is what allows log events to be treated as metrics with dimensions. This is a top-contributor question, and Amazon CloudWatch Contributor Insights is the feature built to answer exactly that, as CHRIS12722222 noted by referring to it as the mechanism for the top N. Creating a Contributor Insights rule that groups the application logs by instance ID and errors produces a metric set describing each contributor's share (A). A CloudWatch alarm that uses the INSIGHT_RULE_METRIC function then evaluates that rule's metric to determine whether a specific instance is responsible for more than half of all errors, and it notifies the existing SNS topic when the condition is met (D). Because both the analysis and the threshold evaluation are performed by managed services using data already collected, no pipeline, script, or function has to be built, which is what the least-operational-overhead requirement asks for. uncledana described A and D as a streamlined, automated way to track which instance contributes a high percentage of errors and alert when the threshold is crossed, with minimal manual intervention. A and D are the correct combination.

Why the Other Options Are Wrong

C creates a metric filter counting the occurrence of the term Error and a CloudWatch alarm using the METRIC_COUNT function. A metric filter produces a single aggregate metric containing the total count of matching log events, with no dimension identifying which instance produced them; METRIC_COUNT on that metric therefore tells the team only that errors occurred, not whether one instance accounts for more than half of them. This cannot answer the attribution question, and CHRIS12722222 identified Contributor Insights as the feature that provides top-N attribution. E creates a CloudWatch Logs subscription filter that filters for errors and invokes an AWS Lambda function, with the function sending the instance ID and error to an SNS topic. This requires developing, deploying, and maintaining a function that parses and attributes every error record, which is substantially more operational overhead than a managed Contributor Insights rule and contradicts the least-overhead requirement. B creates a resource group in AWS Resource Groups, uses CloudFormation to group the application's resources, and adds the application to CloudWatch Application Insights to identify the application. Application Insights delivers application health, performance, and availability monitoring for the application as a whole; it does not provide per-contributor attribution of error volume, which is what the requirement asks for. A and D are correct.

Community Comment Notes

Community voted A,D unanimously. Srikantha explained that CloudWatch Contributor Insights can analyze CloudWatch logs and aggregate them by custom dimensions such as instance ID, which addresses the attribution question. CHRIS12722222 identified the key point in two words, contributor insight for top N, which is what makes option A the correct analysis step and rules out the aggregate-only metric filter in C. uncledana described A and D as providing a streamlined and automated way to track which instance is contributing a high percentage of errors and to alert when the threshold is crossed, with minimal manual intervention. No alternative received support.