Skip to main content
This lesson demonstrates practical, hands-on usage of Amazon CloudWatch for logs, Live Tail, Logs Insights, metrics, alarms, EventBridge integration, and dashboards. Follow the sections below to learn how to centralize observability, troubleshoot in real time, and create alerts and dashboards for your AWS environment.

​
Logs

CloudWatch Logs is the central store for log data from many AWS services and custom applications. Logs are organized into log groups and log streams:
  • Log group: a collection of log streams that typically represents a service, application, or resource (for example, an AWS Lambda function).
  • Log stream: a sequence of log events, often representing a single resource instance or execution.
Use log groups to set common retention, access control, and subscription filters (for forwarding logs to other services).
A screenshot of the AWS CloudWatch console showing the "Log groups" page with a list of log groups (many for /aws/lambda/*). The table shows columns like retention (several set to "Never expire") and other log group details.
Selecting a log group displays its log streams and the “Last event time” for each stream. Streams can help you locate the most recent activity for a resource.
A screenshot of the AWS CloudWatch console showing a Log streams list with stream names and their "Last event time" timestamps. One entry is highlighted, showing 2023-10-18 21:15:25 (UTC-04:00).
Clicking a log stream shows raw log events. For Lambda you typically see the lifecycle lines (START / END / REPORT) plus your application INFO/ERROR logs. Example log events from a Macie job (compact JSON per line):
Pretty-printed JSON for readability:
Set appropriate retention on log groups to control storage costs and meet compliance requirements. You can change retention and create subscription filters to forward logs to Lambda, Kinesis, or third-party systems.

​
Live Tail

Live Tail streams log events in near real time from one or more selected log groups. It’s useful for debugging live traffic or testing changes.
  • Choose the log groups to include.
  • Apply filters (by text, JSON field, or log stream).
  • Start the Live Tail session to stream newly generated events to the console.
A screenshot of the AWS CloudWatch "Live Tail" interface showing the Filter panel with selectable log groups (for example /aws/lambda/test1 is checked). The main pane is empty with a "Select a log group to start your Live Tail session" prompt and a Start button at the top-right.
When a Lambda function runs during a Live Tail session you will see its START/INFO/END/REPORT lines and any application logs appear immediately:
Live Tail shows live data — avoid displaying sensitive log contents in shared screens or dashboards. Filtering and sampling can reduce noise and cost.
You can tail multiple log groups concurrently and filter by message content, JSON fields, or log stream identifiers.

​
Logs Insights

CloudWatch Logs Insights provides an interactive query language to filter, parse, and aggregate logs for in-depth analysis and visualization. Common query patterns:
  • Show the most recent events:
  • Show oldest matching events (small result set):
Run queries against selected log groups to get a visual timeline and detailed matching events. Use parsing functions (parse, parse regex), stats for aggregation, and bin() for time bucketing to build charts.

​
Metrics

CloudWatch Metrics supply both platform-provided and custom application metrics. Metrics are organized by namespace (for example, AWS/EC2, AWS/Lambda) and can be filtered by resource identifiers.
  • Standard EC2 metrics: CPUUtilization, NetworkIn, NetworkOut, DiskReadOps, etc.
  • Lambda metrics: Invocations, Errors, Duration, Throttles.
  • Custom metrics: push using the PutMetricData API.
Select an EC2 or other resource metric to view a time-series chart and change the statistic (Average, Sum, Min, Max) and period.
A screenshot of the AWS CloudWatch console showing an empty metric graph at the top and a list of instance metrics (CPUUtilization, EBSReadOps, DiskWriteOps, etc.) with "No alarms" in the table below. The left sidebar shows navigation for Alarms, Logs, Metrics, and other CloudWatch features.

​
Alarms

CloudWatch Alarms evaluate metrics against thresholds and trigger actions (SNS, Auto Scaling, Lambda, Systems Manager, etc.) when conditions are met. Create an alarm:
  1. Go to Alarms → Create alarm.
  2. Select the metric (for example, CPUUtilization for an EC2 instance).
  3. Choose statistic and period (e.g., Average, 5 minutes).
  4. Select threshold type (static or anomaly detection) and specify the condition (e.g., GreaterThanThreshold = 60).
  5. Configure actions (for example, publish to an SNS topic).
  6. Name and create the alarm.
To make these steps easy to scan, here’s a quick reference table:
Screenshot of the AWS CloudWatch alarm configuration page showing a CPUUtilization graph on the left and a metric-statistics dropdown (Average selected) with period settings on the right. The left sidebar lists the alarm creation steps.
When triggered, alarms can perform automated remediation or notify operators. Example: an alarm configured for average CPU > 60% over a 5-minute period will enter ALARM state and run its actions if the condition holds.
A screenshot of the AWS CloudWatch console showing a metric preview for an EC2 instance, with a CPUUtilization graph that spikes above a red threshold line. The right panel lists metric details (Namespace: AWS/EC2, InstanceId, statistic Average, period 5 minutes).

​
Events / EventBridge

CloudWatch Events evolved into Amazon EventBridge. Use EventBridge rules to respond to events in your environment and route them to targets such as Lambda, SNS, SQS, Step Functions, or API destinations.
  • Event source examples: AWS service events, schedule (cron), custom application events.
  • Common targets: Lambda for processing, SNS for notifications, SQS for durable queues.
A screenshot of the Amazon EventBridge web console open to the "Rules" page, showing the selected event bus ("default") and a list of rules (e.g., "instance-status-change" and "my-api"). The sidebar navigation, rule status indicators (Enabled), and a "Create rule" button are also visible.
Use EventBridge for event-driven automation, security monitoring (route GuardDuty findings), and integration patterns across accounts and SaaS partners.

​
Dashboards

CloudWatch Dashboards provide customizable, shareable pages that combine graphs, numbers, and logs into a single view. Dashboards are great for operational runbooks, team overviews, and SRE monitoring. To create a dashboard:
  1. Go to Dashboards → Create dashboard.
  2. Provide a name and select widget types (Line, Number, Gauge, Bar, Pie, Text).
  3. Pick metrics or log groups for each widget, position/resize widgets, then save.
Example: a dashboard with an EC2 CPUUtilization line widget and a NetworkPacketsOut number widget.
A screenshot of an AWS CloudWatch dashboard with two widgets: a CPUUtilization graph showing a sharp spike to about 99.9%, and a NetworkPacketsOut chart with a value of 38.8.
Widgets can surface Lambda invocations, errors, container insights, or any metric you publish. Keep dashboards focused by team, application, or environment.
A screenshot of the AWS CloudWatch "Add widget" dialog listing widget types (Line, Number, Gauge, Bar, Pie, Text, etc.) for building a dashboard. The dialog also shows data-source options (Metrics or Logs) and Cancel/Next buttons.

​
Other Observability Features

  • Traces: integrate CloudWatch with AWS X-Ray for distributed tracing (not covered here).
  • Service Insights: Container Insights and Lambda Insights provide deeper telemetry for those services.
  • Integrations: forward logs to third-party systems or use Metric Streams to push metrics to external observability platforms.

​
Summary

CloudWatch is a comprehensive observability platform that helps you:
  • Centralize logs (CloudWatch Logs) and query them with Logs Insights.
  • Troubleshoot in real time using Live Tail.
  • Monitor metrics (built-in and custom), visualize them, and create alerts with Alarms.
  • Route and react to events with EventBridge (formerly CloudWatch Events).
  • Build and share Dashboards to keep teams informed.
Use CloudWatch to implement monitoring best practices: set retention policies, create meaningful alerts with action plans, and build targeted dashboards for your stakeholders.

​
Quick Reference Table

Watch Video