A CloudWatch alarm for failed logins never changes state. Logs arrive, but the metric filter expects a different field name than the structured event. What should be done first?

1. Add an S3 replication rule to the application bucket.
2. Delete the source logs and recreate the same filter unchanged.
3. Increase the alarm threshold so the missing metric is easier to detect.
4. Test and correct the metric filter against representative actual log events.