Amazon CloudWatch Logs
Store and search logs
Collects and stores logs from Lambda, EC2, containers…; search with Logs Insights, create metrics from logs.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · DVA · SOA
Think of it asLike a shared, searchable diary for every machine.
Where does CloudWatch Logs fit?
Calls CloudWatch Logs
CloudWatch LogsCloudWatch Logs calls
A real example, step by step
- A customer reports a payment failure at 9 p.m. last night, and you need to know what the app logged then.
- Every console.log from Lambda and every container log already goes to CloudWatch Logs, one log group per app.
- You use Logs Insights to filter ERROR lines around 9 p.m. and immediately spot a connection error to the payment gateway.
- You create a metric filter that counts ERROR lines, with an alarm when there are more than 10 in 5 minutes.
- You set 30-day retention on the log group so you don't pay to keep logs forever.
When to use it
✓ Use it when
Debugging, incident investigation, centralized logging.
✗ Avoid it when
Storing logs long-term and cheaply → export to S3.
Common uses
- Logs from Lambda, ECS, API Gateway
- Find errors with Logs Insights
- Create metrics and alarms from logs (metric filters)
CloudWatch Logs, CloudWatch or CloudTrail?
| CloudWatch Logs | CloudWatch |  CloudTrail | |
|---|---|---|---|
| Stores | Application and system logs | Metrics and alarms | History of AWS API calls |
| Written by | Apps, Lambda, the agent, AWS services | AWS services, the agent, apps | AWS automatically |
| Search | Logs Insights | Graphs, dashboards | Event history, CloudTrail Lake |
| Main cost | Data ingested + stored | Custom metrics, alarms | Data events, extra copies |
What does it cost?
- Pricing model: Ingestion ~$0.50/GB (standard logs), storage ~$0.03/GB-month, Logs Insights queries ~$0.005/GB of data scanned.
- Free tier: Always Free: 5 GB (ingestion + storage + scanning) per month.
The line item that bloats bills most: leaving debug logging on in production; keeping retention at 'Never expire'; not moving old logs to S3.
Cut log costs → set retention and export old logs to S3. Turn log patterns into alerts → metric filter + alarm. Process logs in real time → a subscription filter to Lambda, Kinesis or OpenSearch.
Frequently asked questions
How long does CloudWatch Logs keep logs?
By default logs are kept forever, so storage costs keep growing unless you set a retention period. Set retention per log group, for example 30 or 90 days, and export to S3 if you need cheaper long-term storage.
How do I search and analyze logs?
Use CloudWatch Logs Insights to query, filter and aggregate logs. Use metric filters to turn log patterns (such as the number of ERROR lines) into metrics with alarms. Subscription filters stream logs in real time to Lambda, Kinesis or OpenSearch.
How is CloudWatch Logs priced?
By the data ingested, the data stored each month and the data scanned by Logs Insights queries. The Infrequent Access log class is cheaper for logs you rarely search.
What do AWS exams ask about CloudWatch Logs?
Setting retention to reduce cost, metric filters with alarms, exporting to S3 for long-term storage, subscription filters for real-time processing, and installing the CloudWatch agent to send logs from EC2 or on-premises servers.