(Which CloudWatch metric filter includes log events with the word ERROR but excludes log events with the word WARNING?)

A metric filter in Amazon CloudWatch Logs can be used to search for specific terms in log data and

create metrics based on the matches. To include log events with the word "ERROR" and exclude

those with the word "WARNING," the correct syntax involves using a filter pattern with a positive

match for "ERROR" and a negation for "WARNING." The correct pattern is "ERROR -WARN," where

the minus sign (-) indicates exclusion of log events containing "WARN." According to the WGU Cloud

Deployment and Operations Study Guide (Section 4.2, CloudWatch Logs), metric filters use a pattern-

based syntax where terms are included or excluded using positive matches and the negation

operator (-). This ensures that only logs with "ERROR" and without "WARN" are processed into the

metric.