Amazon CloudWatch Logs

Overview

Amazon CloudWatch Logs is a cloud service for collecting, retaining, querying, and monitoring logs across AWS and other environments. It is best suited to teams already using AWS that want log analysis alongside broader observability. Its breadth is compelling, but usage-based charges make volume control central to the buying decision.

Key features

CloudWatch Logs has Standard log groups for real-time monitoring and advanced analytics, and Infrequent Access for ad-hoc queries and forensic analysis. That distinction can help teams reserve continuous analysis for operational logs and use the lower-frequency class for occasional investigation. Logs Insights supports filters, aggregations, and regular expressions; it can visualize time-series data and export query results to CloudWatch Dashboards.

Live Tail gives operators an interactive view of streaming logs from a central interface, useful when investigating activity as it arrives. Anomaly Detection uses machine learning to identify shared log structures, notable content, trends, and anomalies. Data protection policies can scan ingested logs and mask sensitive information using pattern matching and machine learning.

Collection works through the CloudWatch Agent, installed with AWS Systems Manager, or the PutLogData API action. Native integrations span AWS services; third-party sources include CrowdStrike Falcon, Microsoft Office 365, Okta Auth0, Microsoft Entra ID, Wiz, and GitHub Audit Logs. OpenTelemetry, Prometheus, Grafana, and several agent frameworks are also supported. Teams can analyze logs across accounts from a monitoring account, and integrate with Amazon OpenSearch Service without moving or duplicating the data.

Logs are encrypted in transit and at rest, with AWS KMS support for log groups; the service is PCI and FedRAMP compliant. These controls and its cross-account view make it a substantial fit for AWS-centered operations, though teams outside that ecosystem may not benefit as much from its native integrations.

Pricing

CloudWatch Logs has no upfront commitment or minimum fee: usage is billed at the end of the month, and rates vary by Region and tier. Published US East (N. Virginia) ingestion pricing is $0.50 a month for the first 10 TB per month; archive storage is $0.03 a month. These are usage-based rates, not a fixed subscription, so ingestion, retention, and querying volume affect the bill.

The Free tier is free and includes 5 GB for log ingestion, archive storage, and Logs Insights data scanned, plus 1,800 Live Tail minutes per month. It also includes one Contributor Insights rule per month, 10 custom or detailed monitoring metrics, three custom dashboards referencing up to 50 metrics each per month, and 10 alarm metrics for applicable standard-resolution alarms. This is a useful starting allowance, but it is not a substitute for estimating costs at production volumes. Paid Live Tail usage is $0.01 per minute.

Pay-as-you-go and Paid usage have custom pricing beyond the stated rates: charges depend on use and Region, with no minimum commitment. Readers should track Live Tail minutes as well as log volume when forecasting ongoing costs.

Platforms

CloudWatch Logs is cloud-deployed and accessible through web and API. Supported environments include Amazon ECS, Amazon EKS, Red Hat OpenShift on AWS, and Kubernetes on Amazon EC; workloads can also run on premises or in other clouds. Container log collection, runtime events, and resource alerts are supported.

Who it's for

Choose CloudWatch Logs if your team needs log analysis integrated with AWS monitoring, cross-account investigation, or a central view spanning AWS and other workload locations. Its query tools, live view, and security controls serve operational and forensic work. Teams seeking a predictable fixed subscription, or whose operations do not center on AWS, should compare alternatives and model usage costs before committing.

Pros and cons

• Pro: Native AWS integrations and cross-account querying keep log investigations close to AWS operations.
• Pro: Logs Insights combines expressive queries, time-series visualization, and dashboard export.
• Pro: Live Tail, anomaly detection, and sensitive-data masking cover live response and log protection needs.
• Con: Usage-based charges vary by Region and depend on consumption, so forecasting requires attention to volume and feature use.
• Con: The free tier's monthly allowances are finite, including 5 GB across ingestion, archive storage, and query scans.

Alternatives

ELK Stack is worth considering for teams wanting a freemium stack with self-managed deployment options across Linux, macOS, and Windows. Sumo Logic offers a free plan with 20 daily credits, seven-day log retention, and up to three users, making it a fit for a small, capped starting workload.

Elastic Observability is another option for teams seeking a freemium observability product with self-hosted and multi-platform support. Oracle Cloud Infrastructure Logging may suit users comparing a free 10 GB monthly storage allowance with a published storage-based rate.

VictoriaLogs is an alternative with a free, Apache-licensed open-source option. SolarWinds Loggly offers a free tier with 200 MB/day and seven-day retention, while its Standard plan is $79 a month billed annually for 1 GB/day and 15-day retention.

NXLog has a free plan for 10 sources and a Premium plan at $12.12 a month, suited to readers whose source limit and platform needs match those terms. Grafana Cloud Application Observability has a free plan with 2,232 host hours and a Pro option with a monthly platform fee plus usage-based host-hour charges.

For broader comparisons, browse Log Management Software, Real User Monitoring, Metrics Monitoring Tools, and Container Monitoring.

Verdict

CloudWatch Logs is a strong choice for AWS-centered teams that want collection, querying, live log viewing, and cross-account analysis within one cloud service. Its broad integrations and operational tools are the main reasons to choose it; variable, usage-based charges are the reason to look elsewhere or forecast carefully first.