Amazon CloudWatch

{
  "logConfiguration": {
    "logDriver": "awslogs",
    "options": {
      "awslogs-group": "/ecs/my-app",
      "awslogs-region": "ap-southeast-1",
      "awslogs-stream-prefix": "ecs",
      "awslogs-create-group": "true"
    }
  }
}

# Find all errors in the last hour
fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 100

# Count requests by status code
fields @message
| parse @message "* * * *" as method, path, status, duration
| stats count() by status

# Find slow requests (over 1 second)
fields @timestamp, @message
| parse @message "* * * *ms" as method, path, status, duration
| filter duration > 1000
| sort duration desc

import {
  CloudWatchLogsClient,
  PutLogEventsCommand,
  CreateLogStreamCommand
} from "@aws-sdk/client-cloudwatch-logs"

const client = new CloudWatchLogsClient({
  region: process.env.AWS_REGION
})

const LOG_GROUP = process.env.CLOUDWATCH_LOG_GROUP || "/app/custom-logs"

export async function logEvent(
  streamName: string,
  message: string,
  level: "INFO" | "WARN" | "ERROR" = "INFO"
) {
  const logEntry = JSON.stringify({
    level,
    message,
    timestamp: new Date().toISOString(),
    service: "my-app"
  })

  const command = new PutLogEventsCommand({
    logGroupName: LOG_GROUP,
    logStreamName: streamName,
    logEvents: [
      {
        timestamp: Date.now(),
        message: logEntry
      }
    ]
  })

  await client.send(command)
}

// Usage
await logEvent("api-requests", "User signed up", "INFO")
await logEvent("errors", "Payment failed: insufficient funds", "ERROR")