Ops needs to interactively query application logs to find how many 500 errors each API endpoint produced yesterday. Which tool is built for this ad-hoc analysis?
A.CloudWatch metric filters feeding an alarm
Metric filters alert in near-real-time but can't answer one-off analytical questions.
B.CloudWatch Logs Insights queries against the log group
Correct. Purpose-built ad-hoc log query engine.
C.CloudTrail event history
CloudTrail captures AWS API activity, not your app's error logs.
D.VPC Flow Logs
Flow Logs record network traffic, not application events.
Why this answer
Logs Insights is purpose-built for interactive, ad-hoc queries over log data (stats by endpoint, error counts, time ranges). Metric filters + alarms are the complementary pattern for real-time alerting on a pattern — not interactive analysis. CloudTrail records API calls, not application logs.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Monitoring & Remediation practice session.
Practice Monitoring & Remediation