Amazon CloudWatch Logs

A managed log collection, storage, search, and analysis service that centralises log events from AWS services, applications, and infrastructure. It ingests log events into account- and region-scoped log groups and log streams and provides query, metric extraction, retention, and streaming integrations. It typically sits alongside monitoring and observability components to support troubleshooting, alerting, and compliance workflows.

🗂 Resource Category

Management and Governance • Analytics

🧠 Exam Memory Hook

Think: "Centralised logs + query + streaming = Amazon CloudWatch Logs"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates, maintains, and patches the underlying CloudWatch Logs service platform, control plane, and the physical infrastructure that runs the service; AWS also provides the APIs, console, managed storage, query engine (CloudWatch Logs Insights), and built-in integrations. AWS is responsible for the durability and availability of the managed storage layer according to the CloudWatch service model. AWS does not manage customer log data configuration, IAM policies, KMS keys owned by the customer, or customer-deployed agents on compute instances.

Customer responsibilities: The customer configures log groups, log streams, retention settings, metric filters, subscription filters, queries, export tasks, and IAM permissions; the customer is responsible for securing access with IAM, configuring KMS keys for encryption where required, monitoring log ingestion and storage costs, and ensuring agents or instrumentation on EC2, on-premises systems, containers, or custom applications are correctly installed and updated. The customer also designs retention and export policies for compliance and operational needs and monitors alerts and metrics derived from logs.

Patching responsibilities: AWS patches the physical infrastructure and the managed CloudWatch Logs service platform, including the control plane and managed runtime components it provides. The customer patches guest operating systems, installed agents (for example CloudWatch Agent or third-party agents running on EC2 or on-premises), application runtimes, libraries, and any customer-managed services that produce logs. If serverless compute (for example AWS Lambda) produces logs, AWS manages the underlying runtime patching for that compute model but the customer is responsible for their function code and packaged dependencies.

🏗 Typical Architecture

💡 Top 5 Features

Log groups and log streams for organising and isolating log event collections within an account and region.
Configurable retention policies for automatic deletion of log events after a defined period.
CloudWatch Logs Insights for ad-hoc and indexed queries over ingested log events.
Subscription filters to stream log events in near real time to Kinesis, Firehose, or Lambda for processing or forwarding.
Metric filters to extract numeric values from log events and create CloudWatch metrics for alerting.

✅ Top 5 Use Cases

Centralised collection of application and system logs from EC2, on-premises servers, containers, and Lambda for troubleshooting and incident investigation.
Streaming log events to analytics or storage (for example via Kinesis Data Firehose) for near-real-time processing or long-term archival in Amazon S3.
Using CloudWatch Logs Insights to query log data and support root-cause analysis during outages or performance incidents.
Extracting operational metrics from logs with metric filters to drive alarms and automated responses.
Retaining audit and security logs with configured retention policies and exporting them to external archives for compliance.

🏗 Architecture Placement

Amazon CloudWatch Logs functions as the regional, account-scoped central log repository and query engine within an AWS observability stack. It receives log events from AWS services (for example Lambda and VPC flow logs), instances and containers (via agents or APIs), and on-premises systems. It connects to CloudWatch Logs Insights for queries, CloudWatch metrics and alarms via metric filters, and to streaming/export targets through subscription filters or export tasks. Placement is typically alongside CloudWatch metrics and traces to provide a complete monitoring and observability solution.

🎯 Commonly Used With

- Amazon CloudWatch
- AWS Lambda
- Amazon EC2
- AWS Identity and Access Management
- Amazon Kinesis Data Firehose

🌍 5 Real-World Examples

A financial services platform centralises application, database audit, and API gateway logs in CloudWatch Logs to support incident investigations and to export archived logs to S3 for regulatory retention.
A healthcare application aggregates Lambda and container logs into CloudWatch Logs and uses Logs Insights to troubleshoot errors reported during patient data processing workflows.
A retail analytics pipeline streams web server logs from CloudWatch Logs to Kinesis Data Firehose for transformation and delivery into an S3 data lake for downstream analytics.
A telecommunications operations team applies metric filters to network device logs in CloudWatch Logs to generate metrics that feed operational alerts and dashboards.
A technology platform exports long-term logs from CloudWatch Logs to Amazon S3 for cheaper archival and to satisfy company retention policies.

🎓 AWS Exam Clues

Select when you need centralized, account-and-region-scoped log collection with search and retention controls.
Use CloudWatch Logs Insights when ad-hoc querying and interactive analysis of log events is required.
Consider subscription filters to integrate log streams with real-time processors or long-term storage (for example Firehose to S3).
Plan retention policies and export strategies as log ingestion and storage affect cost and compliance obligations.
Control access through IAM roles/policies and use KMS when encryption at rest or cross-account access is required.

📝 Quick Revision

Amazon CloudWatch Logs centralises ingestion, storage, query, and streaming of log events for troubleshooting, monitoring, and compliance. Use it when you need regional account-level log storage, Insights queries, metric extraction, or streaming to analytics; design retention, access control, and export workflows to manage cost and compliance.

🏷 Keywords

log group • log stream • log event • CloudWatch Logs Insights • subscription filter • metric filter • retention policy • export task • KMS encryption • CloudWatch Agent • PutLogEvents API • ingestion