One daily operator decision: "publish this as metric or keep as log?" Both sides of same coin. Metrics enable fast alarms and auto-scaling via time-series + statistics; logs enable debugging via raw detail. Metrics expensive per-minute and per-dollar; logs cardinality-free but slow search. Three bridges connect both worlds — Metric Filter, EMF, Anomaly Detection. Today we deep-dive into their internals.
Applied correctly, these enable: convert existing logs to metrics without code (Metric Filter), unify metrics+logs+trace with one line (EMF), learn hourly normal patterns then alert on anomalies only, no manual work (Anomaly Detection)