Several Lambda functions write JSON logs to CloudWatch Logs with level and service fields.
Interactively investigate existing logs from the last hour and count entries whose level is ERROR by service.
Which feature is most appropriate?
Use CloudWatch Logs Insights to query multiple log groups with a time range, filter, and aggregation.
Detailed explanation
Metrics Insights queries metrics rather than CloudWatch Logs event text.
Metrics Insights queries metrics rather than CloudWatch Logs event text.
Select the groups and time range, filter ERROR records, and use stats to count them by service.
Select the groups and time range, filter ERROR records, and use stats to count them by service.
A metric filter evaluates newly arriving logs after creation. It does not process existing records retroactively.
A metric filter evaluates newly arriving logs after creation. It does not process existing records retroactively.
CloudTrail audits AWS API calls; it does not aggregate Lambda application log text.
CloudTrail audits AWS API calls; it does not aggregate Lambda application log text.
Check official documentation
Compare the following points with the official documentation.
Review Logs Insights filter/stats queries and the non-retroactive behavior of metric filters.
Official references
What to confirm
Filter existing ERROR records and count them by service.
Key points
- CloudWatch Logs Insights
- Log group
- Query filter
Notes
- Environment: AWS SOA-C03 exam guide and the linked AWS documentation
- Reviewed against the linked AWS documentation on 2026-10-03.
Foundation review
Filter before aggregation
With structured level and service fields, filter level = "ERROR" | stats count(*) by service counts errors per service. Select the relevant groups and time range.
Historical investigation and monitoring
Logs Insights investigates stored logs. Metric filters turn newly arriving matches into metrics, without retroactive processing. Narrow the query scope to limit scanned data.