Logstash vs Cloudlytics

There is an official Docker image for Logstash which means it'll likely be well supported and maintained for a while.

Logstash is licensed under Apache 2.0.

There is a rich repository of plugins available categorized as inputs, codecs, filters and outputs.

No dependencies, it's a single .jar file. It's written in JRuby and only requires Java to be installed.

Logstash is commonly used as part of ELK stack, that also includes ElasticSearch (a clustered search and storage system) and Kibana (a web frontend for ElasticSearch).

Logstash is built to fit in your stack.

Filters, also known as "groks", are used to query a log stream. They are provided in a configuration file, that also configures source stream and output streams. Since they are stored in a file, they can be under version control and changes can be reviewed (for example, as part of a Git pull request).

There is a cloud based managed version if you are prepared to pay a few bucks.

You can run on mediocre system without problems

CloudFront analytics allows tracking what content is accessed and organize requests based on origin, amount, data transfered, OS/device/browser used, time, etc.

Cloudlytics can be used to analyze CloutTrail's API calls to understand the geographical origin of requests and identifying unauthorized access attempts.

Provides tools for analyzing bills.

Can schedule turning EC2 instances on and off to optimize resource cost.

Allows setting expenditure threshold values that will trigger an alert if a bill of a service has consumed 80%, 100% or more of set threshold.

Cloudlytics provides insight into requests made to load balancer, including average response time, request path, server responses and client IP addresses.

Usage of development and test environments can be optimized via scheduler. EC2 instances can be turned off when not needed.

The free trial lasts a month and allows uploading 200 MB of logs.

Cloudlytics can gather logs from Amazon's S3, CloudFront, CloudTrail and ELB services and provide insight into access patterns, API calls, requests made to load balancer as well as identify unauthorized access attempts, spam attacks, and help manage expenditure.

Cloud audit can be turned on via CloudTrail. It allows identifying unauthorized access attempts, IP addresses and request statuses.

Spam Reports can be used to identify possible spam requests and the IP address making them.

Custom reports can be used to get insights for specific needs. For example, it's possible to add filters for parameters like edge locations, status, URL query etc. on various available fields like total requests, edge result type.