CloudWatch

Three paths: the CloudWatch agent tailing files on a host, AWS services delivering logs natively (Lambda, the ECS awslogs driver, VPC Flow Logs), or your code calling the PutLogEvents API. All three need IAM permission to create streams and put events.

A Logs Insights query is a pipeline of commands joined by the pipe character: fields or display picks columns, filter narrows rows, sort orders them, limit caps the output. Every event exposes @timestamp, @message, @logStream and @ingestionTime.

A CloudWatch Synthetics canary is a scheduled script that exercises your endpoint the way a user would, so you detect outages with no traffic to measure and catch failures outside your servers — DNS, certificates, CDN, third parties. It is a managed Lambda, with its own role, logs and S3 artifacts.

A log group is the container and the unit of configuration; a log stream is one ordered sequence of events from one source inside it. Retention is set per log group, defaults to never expire, and applies retroactively — older events are deleted.

PutMetricData is a synchronous API call you wait on and pay per request; the Embedded Metric Format lets you print one structured JSON log line that CloudWatch converts into a metric asynchronously. Every distinct combination of dimension values becomes its own billable metric.

A CloudWatch alarm counts how many of the last N periods breached the threshold and fires when M of them did. During the outage the metric stopped being published, so there was nothing to compare, and the default missing-data treatment leaves the alarm unevaluated rather than breaching.

CloudWatch's built-in EC2 metrics are collected outside the instance, at the virtualization layer, so they cover CPU, network and EBS activity but never anything inside the guest. Memory and filesystem usage require installing the CloudWatch agent.

CloudWatch RUM embeds a JavaScript client in your pages that reports page-load performance, Core Web Vitals, JavaScript errors, failed HTTP calls and session/browser context to an app monitor. The browser authorizes with temporary guest credentials from an Amazon Cognito identity pool, and a session sample rate controls volume.

One Logs Insights query can span many log groups: select them individually or by name prefix, and use the @log field to tell events apart. Reaching another account first requires CloudWatch cross-account observability linking that account to your monitoring account.

Use parse to lift path and latency out of @message into named fields, then aggregate with stats: parse @message "path=* latency=*ms" as path, latency | stats pct(latency, 95) as p95 by path, bin(5m).

A metric filter watches a log group for a pattern and publishes a CloudWatch metric when lines match. It reports nothing at first because filters apply only to events ingested after creation — they never backfill — and because non-matching periods publish no data point unless defaultValue is set.

CloudWatch Application Signals auto-instruments supported runtimes to emit standardised latency, error and fault metrics per service and operation, plus a service map and dependency view. Its SLO object tracks a goal over an interval, reporting attainment and remaining error budget rather than just a threshold breach.

CloudWatch cross-account observability designates a monitoring account that creates an Observability Access Manager sink; each source account creates a link to that sink naming the resource types it shares. The monitoring account then reads metrics, log groups and traces in place — one console, no role hopping.

CloudWatch Logs charges mainly for ingestion per GB, with much cheaper per-GB-month storage on compressed data. Levers: ingest less, route high-volume vended logs to S3 instead, use the Infrequent Access log class, and shorten retention — which only touches storage.

CloudWatch charges Logs Insights per gigabyte of log data scanned, and scan volume is set by the log groups and time range selected — not by how selective the filter is. Narrow the selection, not the query.

A subscription filter is a standing rule on a log group that pushes matching events, as they arrive, to Lambda, Kinesis Data Streams, Amazon Data Firehose, or a cross-account destination. Firehose suits bulk delivery to storage; Lambda suits per-event transformation.

A static alarm compares a metric statistic to a fixed number. An anomaly-detection alarm compares it to a band that CloudWatch learns from the metric's own history. A composite alarm evaluates no metric at all — it is a boolean rule over the states of other alarms.

Alarm on a ratio rather than a count: use CloudWatch metric math to divide the 5xx count by the request count and threshold the percentage. Then guard the expression so that zero traffic produces a defined value instead of a gap that leaves the alarm unevaluated.

CloudWatch dashboard variables add a control at the top of a dashboard that rewrites its widgets on selection. A property variable swaps a value such as a dimension, region or account across all widgets; a pattern variable substitutes a matched string anywhere in the dashboard JSON.

Associate a symmetric KMS key with the log group at creation or with AssociateKmsKey. The key policy must let the logs.<region>.amazonaws.com service principal use the key, normally scoped by a condition on the kms:EncryptionContext:aws:logs:arn context key.

A Contributor Insights rule evaluates log events as they arrive and produces a continuously updated ranking of top contributors by a key you choose, plus graphable metrics you can alarm on — unlike a query, which reads history once.

Metric Streams push metric updates continuously through Amazon Data Firehose with near-real-time latency and a per-update charge. Polling GetMetricData pulls on your schedule, costs per API request and throttles as the account count grows. Volume, latency and cost decide it.