Log analysis with facets, correlation, enrichment, and automation in Amazon CloudWatch Log Analytics

This article introduces five new capabilities in Amazon CloudWatch Log Analytics that address friction points when investigating logs at scale across multiple log groups.

• Facets enable visual exploration of log patterns without writing queries, with interactive filtering on indexed fields
• Lookup tables enrich query results with external metadata from CSV files, adding organizational context
• Parameterized queries save reusable templates with fill-in variables, enabling team-wide query sharing
• JOIN and sub-queries correlate data across log groups in single queries for multi-step analysis
• Scheduled queries run automatically on recurring schedules and deliver results to S3 or EventBridge
• Features support Stage 3 (Advanced Observability) of AWS Observability Maturity Model for cross-signal correlation
• Index policies define facet fields per log group; best practice targets low-cardinality fields under 100 unique values
• Cost optimization includes early filtering, field indexing, and aggregation before joins

These capabilities enable engineers to investigate security events and anomalies through saved templates and enriched data without manual query writing or console-based result comparison.