3.2.2.7. Associating CloudWatch Alarms with Metrics

3.2.2.7. Log Analytics: Kinesis, Athena & Logs Insights

Different log analysis tools serve different query patterns. The exam tests whether you choose the right tool for the scenario.

CloudWatch Logs Insights examples:

# Top 10 most expensive Lambda invocations
fields @requestId, @billedDuration, @memorySize
| sort @billedDuration desc
| limit 10

# Error rate per 5-minute window
filter @message like /ERROR/
| stats count(*) as errors by bin(5m)

Athena for S3 logs (CloudTrail, ALB access logs, VPC Flow Logs):

-- Find all unauthorized API calls in CloudTrail
SELECT eventtime, eventsource, eventname, useridentity.arn
FROM cloudtrail_logs
WHERE errorcode = 'AccessDenied'
  AND eventtime > current_timestamp - interval '24' hour
ORDER BY eventtime DESC;

Exam Trap: Logs Insights queries scan all data in the selected log groups for the time range — cost scales with data volume. For frequently-run queries on large log groups, export to S3 and use Athena with partitioning (by date, account, region) to scan only relevant data. Athena with partitioned data can be 10-100x cheaper than repeated Logs Insights queries. Partitioning only helps when queries filter on the partition columns: write Firehose output under date-based prefixes (e.g., Hive-style year=/month=/day=) and use Athena partition projection so new days are queryable without crawlers or MSCK REPAIR TABLE. Format changes such as CSV or GZIP shrink files but still scan every day.