Overview

Amazon CloudWatch Logs is a cloud log service for collecting and retaining data from AWS resources, applications, on-premises systems, and other clouds. It is best suited to teams that already rely on AWS and want logs within its wider observability stack. Its breadth is useful, but the usage-based bill calls for attention to ingestion, storage, and query volume.

Key features

Standard log groups are aimed at real-time monitoring and advanced analytics; Infrequent Access is for occasional queries and forensic work. That split lets teams match log use to the task, but the less frequently accessed class is not a substitute for continuous operational analysis. Logs Insights handles filters, aggregations, and regular expressions, and can chart time-series results or export them to CloudWatch Dashboards.

Live Tail offers an interactive view of incoming logs for incident investigation. Anomaly Detection applies machine learning to find shared log structures, trends, notable content, and anomalies. Data-protection policies can scan ingested logs and mask sensitive information. Logs are encrypted in transit and at rest, with AWS KMS support for log groups; CloudWatch Logs is PCI and FedRAMP compliant.

Teams can publish logs through the CloudWatch Agent, installed with AWS Systems Manager, or the PutLogData API action. Native integrations span AWS services, while direct third-party sources include CrowdStrike Falcon, Microsoft Office 365, Okta Auth0, Microsoft Entra ID, Wiz, and GitHub Audit Logs. OpenSearch integration supports querying and analysis without moving or duplicating logs. Cross-account views let teams search and query from a monitoring account at no additional cost.

CloudWatch also brings together metrics, logs, and traces across AWS environments, with visibility into resource use, application performance, and operational health. Teams can detect anomalies, set alarms, and automate responses. Prometheus, Grafana, and OpenTelemetry support widen its reach beyond AWS, and workloads can run on AWS, on premises, or in other clouds.

Pricing

CloudWatch Logs has no upfront commitment or minimum fee; usage is charged at month-end, with rates varying by region and tier. The Free tier costs 0.00 USD per free and includes 5 GB for log ingestion, archive storage, and Logs Insights data scanned, plus 1,800 Live Tail minutes per month. It also includes one Contributor Insights rule per month, 10 custom or detailed monitoring metrics, three custom dashboards referencing up to 50 metrics each per month, and 10 alarm metrics for applicable standard-resolution alarms. This is a useful allowance for small workloads or evaluation, but teams exceeding the included volumes pay for usage.

Published rates include 0.50 USD per month for ingestion for the first 10 TB per month in US East (N. Virginia), and 0.03 USD per month for archive storage; both vary by region, and ingestion rates also vary by tier. Paid Live Tail usage is $0.01 per minute. Pay-as-you-go and Paid usage have custom pricing rather than a fixed total: the bill depends on usage and region and is charged at month-end. This model avoids a minimum commitment, but makes volume and feature usage central to forecasting.

Platforms

CloudWatch Logs is delivered through API and web access, with cloud deployment. Supported environments include Amazon ECS, Amazon EKS, Red Hat OpenShift on AWS (ROSA), and Kubernetes on Amazon EC. It also supports container log collection, container metrics, resource alerts, and runtime events.

Who it's for

It fits AWS-centric operations teams that want log collection, investigation, alerting, and broader observability in one service, especially when cross-account analysis or AWS integrations matter. Teams can also use it for workloads outside AWS, but those choosing a dedicated log platform primarily for non-AWS environments should weigh that against the service's AWS-wide emphasis. The API and multiple collection paths suit teams integrating log flows into existing operations.

Pros and cons

Pros: Broad native AWS integration brings logs into the same environment as metrics, traces, alarms, and operational views.
Pros: Logs Insights, Live Tail, and anomaly detection cover both interactive investigation and trend analysis.
Pros: Cross-account search and queries from a monitoring account incur no additional charge.
Pros: No minimum fee or upfront commitment, with a defined free allowance across logs, Live Tail, dashboards, and metrics.
Cons: Usage-based charges vary by region and tier, so ongoing cost depends on ingestion, storage, scans, and paid Live Tail use.
Cons: The free tier's 5 GB allowance is shared across ingestion, archive storage, and Logs Insights scans, limiting how far it goes for busy workloads.

Alternatives

For a different log-management shortlist, browse Log Management Software. Teams focused on infrastructure metrics or container monitoring can also compare Metrics Monitoring Tools and Container Monitoring; those categories may be a better starting point when log analysis is not the primary need. For website and app experience measurement, see Real User Monitoring.

InfluxDB is worth considering when a freemium option and broad platform support matter; it offers a free plan and trial, though its Cloud Serverless - Data In price is 0.00 USD per month with pay-for-what-you-use billing. Dynatrace Kubernetes Monitoring is an alternative for teams seeking Kubernetes monitoring with a free trial; its listed hourly pod rate is $0.002 per hour per pod. Checkmk suits teams considering a self-hosted-capable freemium tool: its free Community plan covers up to ~100 hosts and includes 2000+ pre-built integrations with community support.

Nagios XI offers a free tier capped at 7 nodes or 100 services, whichever comes first, for teams willing to self-support. SigNoz is another freemium option, with a community self-hosted plan that leaves infrastructure, storage, scaling, upgrades, and backups to the user. VictoriaMetrics offers open-source single-node and cluster versions for teams considering a freemium platform.

Zabbix is an alternative with a freemium model; its Silver plan is shown at € 245 /month, billed annually, with 8x5 support and a one-day response. LogicMonitor is a paid option with an Essentials starting monthly list price of 16.00 USD per month per hybrid unit, subject to standard minimum quantities and terms.

Verdict

Choose CloudWatch Logs if your team runs primarily on AWS and wants log collection, query, live investigation, and cross-account visibility tied into AWS observability. Its strongest reason to choose is that integrated operational view; its main reason to look elsewhere is that usage-based, region-sensitive charges can be harder to predict as volumes grow.

	Amazon CloudWatch Logs	Hosted Graphite
Free plan	Yes	No
Free trial	No	No
Paid from	$0.03/mo	—
Open source	No	No
Platforms	api, Web	Web
Free plan	No	No
Custom metrics	—	Yes
Query language	—	proprietary
Data ingestion	—	multiple
Self-hosted option	—	No

Amazon CloudWatch Logs vs Hosted Graphite

Amazon CloudWatch Logs

Hosted Graphite