SAP-C02 Continuous Improvement for Existing Solutions Practice Question

A company runs a containerized application on Amazon ECS with the Fargate launch type. The application writes logs to stdout, which are captured by the awslogs driver and sent to Amazon CloudWatch Logs. The operations team notices that during peak hours, log ingestion costs have increased significantly, and they want to reduce costs without losing critical error logs. Which solution should a solutions architect recommend?

⚠ Common exam trap

The trap here is thinking that changing retention or exporting logs will reduce ingestion costs, when the real cost driver is the volume of logs ingested into CloudWatch Logs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use the FireLens log router to filter and route only error-level logs to CloudWatch Logs.

The awslogs driver sends all logs to CloudWatch Logs, incurring ingestion costs. FireLens allows you to filter logs at the source, so only error-level logs are forwarded to CloudWatch Logs. This reduces ingestion volume and cost while preserving critical error logs. It is a native ECS feature that requires only task definition changes, making it the most efficient solution.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure the awslogs driver to use a different log group with a shorter retention period.
Why it's wrong here
Changing the log group or retention period affects storage costs but not ingestion costs, which are the primary driver of the increase. The awslogs driver still sends all logs to CloudWatch Logs, so ingestion charges remain the same. While retention management is good practice, it does not address the root cause of high ingestion during peak hours.
✗
Reduce the ECS task count during peak hours to lower the volume of logs generated.
Why it's wrong here
Reducing task count would degrade application performance and availability, which is unacceptable during peak hours. It does not selectively filter logs and could lead to lost business. The goal is to reduce logging costs without losing critical error logs, not to reduce the application's capacity. This approach is operationally risky and does not address the logging configuration.
✗
Enable CloudWatch Logs subscription filters to export logs to Amazon S3 and delete them from CloudWatch Logs.
Why it's wrong here
Subscription filters stream logs in real time to services like Amazon Kinesis or AWS Lambda, but they do not reduce ingestion costs because all logs are still ingested into CloudWatch Logs first. Exporting to S3 and deleting logs later adds complexity and does not prevent the initial ingestion charges. It also risks losing logs if the export fails.
✓
Use the FireLens log router to filter and route only error-level logs to CloudWatch Logs.
Why this is correct
FireLens is a log router for ECS that uses Fluent Bit or Fluentd to process and route logs. By configuring filters, you can drop non-error logs before they reach CloudWatch Logs, reducing ingestion volume and cost. Critical error logs are still captured, meeting the requirement. This approach is native to ECS and requires only task definition changes.

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Why each option matters

Option-by-option breakdown

Related to this question