CloudWatch

​

What CloudWatch does

• Store and visualize metrics on dashboards.
• Evaluate metrics against user-defined thresholds and raise alarms.
• Extract additional metrics from log data (metric filters).
• Provide ad-hoc log queries and analytics with CloudWatch Logs Insights.
• Trigger notifications and automated workflows when alarms change state.
• Route and react to events using rules and targets (see EventBridge).

​

How CloudWatch collects data

• Many AWS services (for example Amazon EC2, AWS RDS, AWS Lambda, and Amazon ECS) automatically emit metrics and, in many cases, logs to CloudWatch.
• Applications and agents can send logs to CloudWatch Logs using the CloudWatch Logs API (PutLogEvents) or the CloudWatch Agent (for EC2 and on-prem servers).
• Developers can push custom metrics with the CloudWatch SDKs or the PutMetricData API and organize metrics into namespaces to represent application-specific data such as latency or business KPIs.

aws cloudwatch put-metric-data \
  --metric-name PageViewCount \
  --namespace "MyApp/Metrics" \
  --value 1 \
  --dimensions Page=Home

{
  "logEvents": [
    { "timestamp": 1609459200000, "message": "User login succeeded" }
  ],
  "logGroupName": "MyApp/Backend",
  "logStreamName": "i-0123456789abcdef0"
}

​

What you can do with ingested logs and metrics

• Create alarms that evaluate metrics over one or more evaluation periods and trigger actions.
• Define metric filters to extract numerical metrics from log entries (e.g., count of ERROR messages).
• Query logs with Logs Insights to troubleshoot issues and create visualizations for dashboards.
• Route events and react to resource state changes using rules and supported targets (Lambda, SNS, SQS, Step Functions, API destinations).

​

Key CloudWatch components

​

CloudWatch and Auto Scaling

1. Create a metric (or use a built-in metric) such as average CPUUtilization across EC2 instances.
2. Define an alarm that evaluates the metric (for example, CPU > 80% for 5 minutes).
3. Configure the alarm to trigger Auto Scaling policies when the alarm enters the ALARM state (scale out).
4. Configure recovery/scale-in policies for when the alarm returns to OK.

​

Practical notes and typical workflows

• Publish application metrics with PutMetricData or SDKs to monitor application-specific KPIs.
• Use the CloudWatch Agent on EC2 or on-prem hosts to collect system and application logs and metrics.
• Create metric filters on log groups to emit CloudWatch metrics for specific log patterns (e.g., error counts).
• Connect CloudWatch Alarms to SNS for notifications or to Lambda/Auto Scaling for automated remediation.
• Use Logs Insights to run queries, create saved queries, and add visualizations to dashboards for ongoing troubleshooting.

​

Summary

• Amazon CloudWatch ingests metrics and logs from AWS services and custom applications, enabling centralized monitoring and observability.
• CloudWatch evaluates metrics with alarms, visualizes data on dashboards, and triggers notifications or automated actions.
• CloudWatch Logs provides retention, indexing, metric filters, and Logs Insights for deep log analytics.
• Event-driven automation is provided through EventBridge (formerly CloudWatch Events), which routes events to targets.
• Use dashboards and Insights to observe, troubleshoot, and optimize application and infrastructure performance.

​

Links and references

• Amazon CloudWatch product page
• Amazon EventBridge
• Amazon Simple Notification Service (SNS)
• Auto Scaling
• Kubernetes Basics