Question

A DevOps team runs a fleet of application servers that send logs to a single CloudWatch Logs log group. Support engineers report that intermittent surges in application error messages are only noticed hours later when customers complain. The team wants an automated, low-maintenance way to detect statistically abnormal spikes in the rate of ERROR-level log entries without manually defining static thresholds, since normal error volume varies significantly by time of day. What approach best meets this requirement?

Accepted Answer

Create a metric filter that increments a custom metric for ERROR entries, then enable a CloudWatch anomaly detection alarm on that metric using a band based on the anomaly detection model.

Answer

Create a metric filter for ERROR entries and configure a static CloudWatch alarm that triggers when the count exceeds a fixed threshold of 100 per minute.

Answer

Schedule a CloudWatch Logs Insights query to run every hour that counts ERROR entries and email the results to the support team.

Answer

Enable CloudWatch Logs live tail on the log group so engineers can watch ERROR entries stream in real time during business hours.