Question 796 of 1,511
Centralized Logging for ECS Microservices: CloudWatch Logs Insights
A company has a microservices architecture with 50 services running on Amazon ECS. The DevOps team wants to collect and analyze logs from all services centrally. They need to query logs across services and set up alerts for error patterns. Which solution is the most scalable and cost-effective?
Quick Answer
The correct answer is to use the awslogs driver to send logs to Amazon CloudWatch Logs and then leverage CloudWatch Logs Insights for querying and metric filters for alerts. This solution is the most scalable and cost-effective for centralized logging for ECS microservices because the awslogs driver natively integrates with the ECS agent, automatically streaming container stdout and stderr to CloudWatch Logs without additional infrastructure. CloudWatch Logs Insights then provides a purpose-built query engine to search across all 50 services in seconds, while metric filters enable real-time alerting on error patterns without the latency of S3-based solutions. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your ability to balance operational simplicity with cost—common traps include choosing S3 with Athena (cheaper but lacks real-time alerts and has slower queries) or Elasticsearch (overly complex and expensive for this scale). Remember the memory tip: “Logs to CloudWatch, query with Insights, alert with filters—no extra servers required.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the awslogs driver to send logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights for querying and metric filters for alerts
Using the awslogs driver to send logs to Amazon CloudWatch Logs provides a fully managed, scalable, and cost-effective solution. CloudWatch Logs Insights enables querying across all services, and metric filters can trigger alarms for error patterns. Option A (CloudTrail) captures API activity, not application logs. Option B (Elasticsearch) requires managing infrastructure and is more expensive. Option D (S3 + Athena) is cheaper but lacks real-time alerting and has slower query performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS CloudTrail to capture all log events and store them in an S3 bucket for analysis
Why it's wrong here
Incorrect. CloudTrail captures API calls, not application logs.
- ✗
Deploy an Amazon Elasticsearch cluster and configure the ECS Fargate agent to send logs directly to Elasticsearch
Why it's wrong here
Configuring an ECS Fargate agent to send logs directly to an Amazon Elasticsearch cluster is not technically feasible. Fargate tasks do not expose an agent that can be configured for direct log forwarding; logs must be routed via a log driver (like `awslogs` to CloudWatch Logs) or a sidecar container running a log router such as Fluent Bit. However, Amazon OpenSearch Service (formerly Elasticsearch) is an excellent solution for centralising, querying, and alerting on logs, making it a strong choice if a proper log routing mechanism were in place.
- ✓
Use the awslogs driver to send logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights for querying and metric filters for alerts
Why this is correct
Correct. This is scalable, integrates with ECS, and provides real-time alerts.
- ✗
Send logs to Amazon S3 and use Amazon Athena for querying, with scheduled queries for alerts
Why it's wrong here
Incorrect. Athena is suitable for ad-hoc analysis but not real-time alerting.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is running a production microservices architecture on Amazon ECS with Fargate. The operations team wants to set up centralized logging across all services, including the ability to search logs in near real-time and retain them for 3 years. The logs are currently sent to CloudWatch Logs. Which combination of services would meet these requirements with the least operational overhead?
hard- A.Stream logs to Amazon OpenSearch Service (Elasticsearch) using a CloudWatch Logs subscription filter.
- ✓ B.Set a retention policy of 3 years on the CloudWatch Logs log groups and use CloudWatch Logs Insights for searching.
- C.Export logs to Amazon S3 and use Amazon Athena to query them.
- D.Use Amazon Kinesis Data Firehose to deliver logs to Amazon S3 with a 3-year lifecycle policy.
Why B: CloudWatch Logs supports near real-time search via CloudWatch Logs Insights and allows setting a retention policy of up to 10 years, which meets the 3-year retention requirement with minimal operational overhead since it's a managed service within AWS. Option A is wrong because Amazon OpenSearch Service adds operational overhead for cluster management and is not necessary for simple log search. Option C is wrong because exporting logs to S3 and querying with Athena introduces latency and is not near real-time. Option D is wrong because Kinesis Firehose to S3 lacks built-in search capabilities and would require additional services for querying, increasing complexity.
Last reviewed: Jun 20, 2026
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.