Question

A payment processing service on EC2 writes structured JSON application logs to a CloudWatch Logs group. The operations team needs to be paged whenever the application emits more than 10 log entries containing "level":"ERROR" within any 5-minute window. They also need a persistent record of the error count over time so they can graph trends on a dashboard. The solution must avoid running any custom log-scanning code. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs metric filter matching the ERROR pattern that publishes to a custom metric, then create a CloudWatch alarm on that metric with a threshold of 10 over a 5-minute period and an SNS action to the paging system.

Answer

Schedule a CloudWatch Logs Insights query every 5 minutes using EventBridge Scheduler, parse the result count in a Lambda function, and publish an SNS notification when the count exceeds 10.

Answer

Configure a CloudWatch Logs subscription filter that streams all log events to a Lambda function, which counts ERROR entries in memory and triggers SNS when the count passes 10 within 5 minutes.

Answer

Enable CloudWatch Logs anomaly detection on the log group and create an alarm on the anomaly detector that notifies SNS when error volume deviates from baseline.