CloudWatch Alarms Now Directly Query Logs

CloudWatch alarms can now be configured directly from log queries, bypassing metric filters.

What changed

• Alarms can be created directly from CloudWatch Log Insights queries.
• Thresholds are specified directly within the alarm configuration.
• This eliminates the need for intermediate metric filters or custom metrics.

Why it matters

The honest version: This feature streamlines the process of creating alerts based on log data. Previously, engineers had to create a metric filter from a log query, then create an alarm on that metric. This new capability collapses those steps into a single workflow, reducing operational overhead and accelerating the time to alert. In practice: Workloads that frequently rely on log-based anomaly detection, such as error rate monitoring or security event tracking, will benefit from a simpler setup. This pairs well with services like Amazon SNS for notifications.

The catch

Watch out: While this simplifies alarm creation, the underlying query execution and alarm evaluation still incur costs. The announcement does not specify any new quotas or limits related to the number of log query-based alarms or the complexity of queries supported. This feature is not available in the Middle East (UAE) or Middle East (Bahrain) regions. What this replaces: The manual creation of metric filters and custom metrics solely for the purpose of triggering CloudWatch Alarms.

Ship it

If you are currently using metric filters to monitor log data for specific patterns or error rates, re-evaluate those setups. Consider migrating to direct log query-based alarms to simplify your monitoring architecture and potentially reduce configuration complexity. This is available in all commercial AWS Regions except Middle East (UAE) and Middle East (Bahrain).

Bottom line: CloudWatch log alarms can now be created directly from queries, simplifying monitoring workflows.

— Filed to /aws