AWS Cloudwatch, S3 and Logging Solution Assistance

Question

We have thousands of EC2 instances pushing logs to various Cloudwatch Log Groups & Stream. However, because of the huge amount of logs, we are not able to download them efficiently. What other architecture can we use so that we can store the logs from those instances which is also easily downloadable? Thank you in advance !

Answer 1

The most common way of coppying logs to S3 from CloudWatch Logs in real-time is through CloudWatch Logs Subscription Filter for Firehose :

In this example, you'll create a CloudWatch Logs subscription that sends any incoming log events that match your defined filters to your Amazon Kinesis Data Firehose delivery stream.

In the firehose stream you would set S3 destination ,