A company wants to enrich application logs in near-real-time and use the enriched dataset for further analysis. The application is running on Amazon EC2 instances across multiple Availability Zones…

Question

Options

• AUse a CloudWatch Logs subscription to send the data to Amazon Kinesis Data Firehose.
• BExport the raw logs to Amazon S3 on an hourly basis using the AWS CLI.
• CConfigure the application to write the logs locally and use Amazon Kinesis Agent to send the data
• DExport the raw logs to Amazon S3 on an hourly basis using the AWS CLI.

• A
  77% (44)
• B
  12% (7)
• C
  4% (2)
• D
  7% (4)

Explanation

The requirement is near-real-time enrichment using a DynamoDB lookup source. A CloudWatch Logs subscription filter continuously streams log events to Amazon Kinesis Data Firehose in near-real-time without any polling delay. Kinesis Data Firehose supports a Lambda transformation function that can query DynamoDB to enrich each log record before delivering the data to a destination (e.g., S3, OpenSearch). This satisfies both 'near-real-time' and 'enrichment from DynamoDB' requirements in a fully managed, event-driven pipeline. Hourly S3 exports (B/D) are batch operations that cannot achieve near-real-time enrichment. Using Kinesis Agent (C) on EC2 would bypass CloudWatch Logs entirely and require the application to write to local files, adding unnecessary complexity when CloudWatch Logs is already the log store.

No community discussion yet for this question.