I have been super-unsatisfied with the status quo of Cloudwatch; it is not a production grade logging system if it allows you to keep zillions of streams in logs but provides A) no way to search through them all to find the last time you had a certain error containing a certain string (grep -r -i on EFS plain text logs is better than Cloudwatch!), and B) no way to trend specific errors/issues over time.

It does seem like as of last week's announcement they are starting to try to fix this. I was annoyed we had to log stuff to both Cloudwatch and Splunk to try to get decent logging.