Search Across Multiple CloudWatch Log Groups for Error Patterns
A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)
Quick Answer
The answer is to use CloudWatch Logs Insights or export logs to Amazon S3 and query with Amazon Athena. CloudWatch Logs Insights is purpose-built for searching across multiple CloudWatch log groups for error patterns using its own query language, allowing you to filter, aggregate, and visualize log events without moving data. The export-to-S3-and-Athena option is equally valid because Athena can run SQL queries over the exported log files in S3, making it ideal for large-scale or complex pattern analysis. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your ability to distinguish native cross-log-group query tools from single-log-group features like filter patterns or subscription filters. A common trap is choosing CloudWatch Logs filter patterns, which only work within one log group at a time. Memory tip: think “Insights for instant cross-group search, Athena for SQL over S3 archives.”
⚠ Common exam trap
Many candidates think Lambda or Kinesis are suitable for ad-hoc log searching, but they are designed for real-time processing or custom workflows, not for efficient cross-log-group querying like CloudWatch Logs Insights or Athena.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CloudWatch Logs Insights to run queries across multiple log groups.
CloudWatch Logs Insights is purpose-built for querying log data across multiple log groups. It uses a query language to search, filter, and aggregate log events, making it ideal for identifying error patterns across different sources. This option is correct because it directly supports cross-log-group queries without additional data movement or infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use CloudWatch Logs Insights to run queries across multiple log groups.
Why this is correct
CloudWatch Logs Insights can query multiple log groups simultaneously.
- ✓
Export the logs to Amazon S3 and use Amazon Athena to query the logs.
Why this is correct
Exporting to S3 and using Athena provides a serverless SQL query capability.
- ✗
Install the CloudWatch Logs agent on an EC2 instance and tail the logs.
Why it's wrong here
The agent is used to send logs to CloudWatch, not to search across log groups.
- ✗
Create a Lambda function that reads logs from each log group and searches for the pattern.
Why it's wrong here
While possible, it's not a recommended or efficient method for ad-hoc searching.
- ✗
Use Amazon Kinesis Data Analytics to process the log streams.
Why it's wrong here
Kinesis Data Analytics is for real-time analysis of streaming data, not for querying stored logs.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search and analyze logs from multiple EC2 instances in real time. Which TWO services can be used to achieve this? (Choose TWO.)
medium- ✓ A.Amazon OpenSearch Service.
- B.Amazon Athena.
- C.Amazon QuickSight.
- D.Amazon Kinesis Data Analytics.
- ✓ E.CloudWatch Logs Insights.
Why A: CloudWatch Logs can stream logs to Amazon OpenSearch Service for real-time search and analytics. Option E is correct because CloudWatch Logs Insights allows real-time querying of log groups directly within CloudWatch. Option B is incorrect: Amazon Athena is designed for querying data in S3, not for real-time log search from EC2 instances. Option C is incorrect: Amazon QuickSight is a business intelligence service for visualization, not real-time log search. Option D is incorrect: Amazon Kinesis Data Analytics is for analyzing streaming data, not directly searching CloudWatch Logs.
Variation 2. A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search across multiple log groups and visualize trends. Which TWO services can be used together to achieve this?
medium- ✓ A.CloudWatch Logs Insights.
- B.Amazon Elasticsearch Service with Kibana.
- C.Amazon Athena.
- D.Amazon QuickSight.
- ✓ E.CloudWatch Dashboards.
Why A: Options A and E are correct. CloudWatch Logs Insights can query across multiple log groups using a SQL-like query language, and CloudWatch Dashboards can visualize the results by adding graphs and widgets. Option B (Amazon Elasticsearch Service with Kibana) is not directly integrated with CloudWatch Logs for real-time querying; it requires setting up subscriptions and additional infrastructure. Option C (Amazon Athena) queries data in Amazon S3, not directly in CloudWatch Logs. Option D (Amazon QuickSight) is a business intelligence tool that typically requires data in S3 or a database, and is not optimized for direct CloudWatch Logs querying.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.