Requirement Summary:

EKS containers sendlogs to CloudWatch Logs

Need toprocess logs in real time

Trigger logic based on aspecific errorin logs

Evaluate Options:

Option A: SNS topic with filter policy

❌SNS filter policies work onmessage attributes, not onCloudWatch Logs subscription filters

Option B: Subscription filter on log group

✅This enablesreal-time log processing

You can create asubscription filterwith apattern matching specific error strings

Sends matched logs to aLambda functionorKinesis

Option C: CloudWatch agent operator for trace collection

❌Irrelevant for log processing

Used formonitoring and tracing, notreal-time log filtering

Option D: Lambda function to process logs

✅Once logs match the pattern, Lambda canprocess and act(e.g., alert, store, analyze)

Option E: EventBridge rule on a schedule

❌Not real-time

Scheduled EventBridge rules are forcron-like tasks, not log stream processing

Subscription filters:https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html

Real-time log processing with Lambda:https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html#LambdaExample

Logs in EKS to CloudWatch:https://docs.aws.amazon.com/eks/latest/userguide/fargate-logging.html