Question

A platform team is debugging an intermittent 5xx error in a production microservice running on ECS Fargate. The application writes structured JSON logs to a single CloudWatch Logs log group. During the debugging session, engineers need to watch new log events as they arrive in near real time and dynamically filter for entries where the field 'statusCode' is 503, without repeatedly re-running historical queries or waiting for query completion. Which approach best meets this requirement with the least operational effort?

Accepted Answer

Use CloudWatch Logs Live Tail on the log group and apply a filter pattern such as { $.statusCode = 503 } to stream matching events in real time.

Answer

Create a CloudWatch Logs Insights scheduled query that runs every minute filtering for statusCode = 503 and view the results in a dashboard widget.

Answer

Configure a metric filter on the log group for statusCode = 503, publish a custom metric, and create a CloudWatch alarm that notifies engineers via SNS.

Answer

Create a subscription filter that streams matching log events to a Lambda function that writes them to a DynamoDB table the engineers can poll.