Question

A DevOps team runs a fleet of microservices that write structured JSON logs to a single CloudWatch Logs log group. Every morning an on-call engineer manually opens CloudWatch Logs Insights and runs a saved query to count HTTP 5xx responses grouped by service over the previous 24 hours, then copies the results into a report. Leadership wants this daily aggregation delivered automatically to an S3 bucket without requiring anyone to open the console. Which solution requires the LEAST custom code and operational overhead?

Accepted Answer

Create an EventBridge scheduled rule that triggers a Lambda function which calls the CloudWatch Logs Insights StartQuery and GetQueryResults APIs, then writes the formatted results to S3.

Answer

Enable a CloudWatch Logs subscription filter on the log group that streams all log events to a Kinesis Data Firehose delivery stream configured to write to S3, then query with Athena.

Answer

Create a metric filter on the log group for 5xx responses, set a daily CloudWatch alarm, and configure the alarm action to export metrics to S3.

Answer

Schedule a CloudWatch dashboard snapshot export using EventBridge and store the rendered dashboard image in S3 each morning.