Operators always start troubleshooting at logs. Metrics tell you "one indicator is abnormal," but logs tell you "exactly which request caused which exception." That's why CloudWatch Logs is operator tool #1. Simultaneously, it's one service most likely to explode your bill. Set no retention policy and let VPC Flow Logs stream through; you get a $10,000 invoice a month later.
Today we explore the internal structure, cost structure, retention and search patterns, subscription patterns, and VPC Flow Logs destination choices of Logs from an operator perspective.