There's more...

• CloudWatch logs supports ingestion of traditional text-based log entries as well as JSON formatted logs.
• Logs can be ingested from other sources including CloudTrail, IAM, Kinesis Streams and Lambda.
• By default, logs are stored indefinitely. You can customize this time period to suit your needs however.
• Metric filters, like the one we created previously, can be used to graph and chart in the CloudWatch console. Add them to your dashboards as well as your alerting system.
• The CloudWatch web console allows you to test metric filters before you add them. Using this feature will save you a lot of trial and error with CloudFormation. Don't rely on the web console completely however: you should move these metric filters to CloudFormation as soon as you get them right.
• There is a one-one relationship between a log stream and a log source. For example, you can't have multiple instances sending /var/log/secure to the same log stream.
• The non-alarm state for the alarm we've created, will be INSUFFICIENT_DATA. This is because our metric filter outputs a value only if a login is detected.