A developer added a CloudWatch Logs metric filter to count exceptions in application logs, but no metric data appears. Why might no filtered results be returned?

The correct answer is that CloudWatch Logs only publishes metric data for log events that occur after the metric filter is created. Metric filters process incoming log events in real-time. They do not retroactively scan existing log data. Therefore, if the exceptions occurred before the filter was established, no metric data will be generated for those past events. Incorrect options: CloudWatch interface VPC endpoints are for private access to CloudWatch APIs, not a prerequisite for metric filtering functionality itself. Streaming to Amazon OpenSearch Service (formerly Elasticsearch Service) is a separate log analysis feature and not required for CloudWatch Logs metric filters to function. Exporting logs to Amazon S3 is for long-term archival or further analysis, not a prerequisite for real-time metric filtering within CloudWatch Logs.