Emit your logs in JSON for structural search and use CloudWatch Logs Insights. It's actually really very good these days--we have an ELK cluster because the team is used to the Kibana interface but I rarely if ever use it.

I haven't had this problem. For simple string searches CloudWatch returns exactly what I'm looking for, even for partial word matches, and for more complicated queries there is the excellent Insights feature.

Oh yeah. They are horrible. I agree completely. For C#, I use Serilog for logging to both a Cloudwatch sink and a ElasticSearch sink. Before I’ve used a Mongo sink.