A Lambda function writes plain-text log lines such as 'order=1182 status=FAILED region=eu-west-1' to a CloudWatch log group. An engineer wants the order ID and status to appear as queryable fields in Logs Insights. Which command pulls those values out of the message text?
Show answer and explanation
Answer: D
The parse command in CloudWatch Logs Insights extracts values from a field using a pattern with named placeholders or regular expressions, and the extracted names can then be used in filters, stats and sorts. It is the right tool when the message is unstructured text. The stats command aggregates, fields chooses which existing fields to show, and limit only caps how many rows are returned.
Why the other options are wrong
- A. stats computes aggregates such as counts and averages across groups of events, but it does not create new fields from message text.
- B. fields selects or displays fields that already exist on the events, so it cannot pull a value out of a plain message string.
- C. limit restricts how many result rows come back and has no effect on which values are extracted from the log text.