Question

A SysOps administrator manages a fleet of application servers that write structured JSON logs to a single CloudWatch Logs log group. The security team wants a daily summary of how many times each unique error code appeared in the previous 24 hours, delivered automatically without a human running any queries. The solution must minimize custom code and ongoing maintenance. Which approach best meets these requirements?

Accepted Answer

Create a CloudWatch Logs Insights query that parses and aggregates error codes, then use an EventBridge Scheduler rule to invoke a Lambda function daily that runs the query with StartQuery and publishes the results to an SNS topic.

Answer

Create a metric filter for every possible error code, publish each as a custom metric, and build a CloudWatch dashboard that the security team reviews each morning.

Answer

Enable a subscription filter on the log group that streams all log events to Amazon Kinesis Data Firehose and configure Firehose to email a daily digest.

Answer

Configure a CloudWatch alarm on the log group's IncomingLogEvents metric with a daily period and attach an SNS action to send the summary.