A SaaS provider runs dozens of microservices on Amazon ECS across several accounts, and each service writes application logs to its own Amazon CloudWatch Logs log group. The operations team wants engineers to search and correlate logs from every service and account in one place, retain the data for two years, and run ad hoc queries during incidents, all with minimal infrastructure to operate. Which approach BEST centralises the logs for cross-service investigation?
- AInstall the unified CloudWatch agent on every task to ship logs straight to a self-managed OpenSearch cluster running in one central account, and have engineers use the cluster dashboards to search and correlate events across all of the services.
- BExport each log group to Amazon S3 on a daily schedule, build an AWS Glue crawler over the buckets, and have engineers query the partitions with Amazon Athena whenever they need to correlate events across the services.
- CStream every log group to a central account with CloudWatch Logs subscription filters through Amazon Kinesis into a destination log group, then query the consolidated data with CloudWatch Logs Insights and set retention to two years. Correct
- DEnable AWS CloudTrail Lake in the central account and direct the service logs into the event data store so that engineers can run SQL queries across two years of activity collected from every account.
Why A is wrong: A self-managed OpenSearch cluster gives strong search but adds nodes, scaling and patching that the team must operate, which conflicts with the requirement to keep operational infrastructure to a minimum.
Why B is wrong: Daily exports add hours of delay so logs are not available during a live incident, and the Glue plus Athena pipeline is more moving parts to operate than a near real time streaming approach to a central log store.
Why C is correct: Subscription filters forward log events in near real time to a central account, and CloudWatch Logs Insights provides ad hoc cross-service queries while a per-group retention setting keeps the data for two years with no servers to run.
Why D is wrong: CloudTrail Lake stores API and selected activity events, not arbitrary application log lines from the microservices, so it cannot hold or correlate the ECS application logs the team needs to investigate.