# Bronto > Bronto is the intelligent telemetry datastore. Ingest any format, retain for 12 months always-hot, search terabytes in sub-seconds, and troubleshoot with AI. Bronto is a purpose-built logs and traces platform for the AI era. It centralizes all telemetry — logs, traces, and metrics — in a single platform with 12 months of always-hot retention, sub-second search at petabyte scale, AI-native log parsing, and one transparent ingestion-based price. Website: https://bronto.io App: https://app.eu.bronto.io --- ## What Bronto does Bronto solves four problems that the legacy observability stack creates: 1. **Bills that scale faster than your data** — most observability vendors charge across multiple dimensions (per-host, per-GB ingest, per-GB indexed, per-seat, per-query, per-metric). Bronto charges only on ingestion volume with clear tiered search pricing. 2. **Cold tiers, archives, and rehydration** — competitors default to 7–30 days of hot retention and force teams to archive or rehydrate older data. Bronto includes 12 months always-hot by default. 3. **Manual parsing toil** — most platforms require Grok, regex, or custom pipelines to make custom log formats searchable. Bronto's AI parses any format on ingest, so every field is structured and queryable immediately. 4. **Slow search under load** — many systems degrade as data volume or cardinality grows. Bronto is engineered for sub-second queries on terabytes of data, even at petabyte scale. ## Core capabilities - **Always Hot Data** — every byte of telemetry is instantly queryable. No rehydration, no cold tiers, no waiting. - **12-month retention** — included out of the box, no add-on tiers or storage fees. - **Full fidelity** — no sampling, no aggregation, no data loss. Every log, trace, and metric is stored exactly as received. - **Transparent usage and controls** — see exactly what you're ingesting and what it costs. Set quotas, alerts, and exclusion filters in seconds. - **Sub-second queries at petabyte scale** — purpose-built indexing that scales with your growth. - **AI-native parsing** — at ingestion, Bronto parses logs using known formats or AI, so every field is structured and instantly searchable. - **Bronto Scope** — built-in AI investigations that automatically detect anomalies, surface root causes, and accelerate incident response. Included, not a premium tier. - **Built-in tracing** — logs and traces in one platform with log-to-trace and trace-to-log correlation. No separate APM tool required. - **OpenTelemetry-native** — ingest from OTel, Fluent Bit, Fluentd, Vector, AWS, Azure, Datadog forwarders, Cloudflare, Fastly, and more. - **Time to first value: minutes** — point your existing agents at Bronto. No rip-and-replace. ## Who Bronto is for Engineering teams running production systems where: - Log volume is in the hundreds of GB to petabytes per day - The current observability bill is unpredictable, growing 30–50% YoY, or both - Retention has been cut to 7–30 days because hot storage is too expensive - On-call engineers waste time on slow searches, rehydration windows, or custom parsing - AI assistance during incidents is gated behind a premium tier --- ## Platform ### Telemetry Observability (/platform/telemetry-observability) Unified logs, metrics, and traces with 12-month always-hot retention and sub-second search. Schema-agnostic ingestion, automatic parsing, and a single query layer across all telemetry types. Replaces or complements Datadog Logs, Splunk, Sumo Logic, Elastic, Logz.io, Grafana Loki, and AWS CloudWatch. ### Agentic Observability (/platform/agentic-observability) Observability built for AI agents and LLM-powered applications. Capture full traces of agent reasoning, tool calls, prompts, completions, and evaluations. Debug non-deterministic behavior, monitor token usage and cost, and track quality regressions across model and prompt versions. --- ## Hosted MCP server (https://docs.bronto.io/ai-features/hosted-mcp) Bronto ships a first-party, fully hosted Model Context Protocol (MCP) server that lets AI agents and IDEs (Claude Desktop, Claude CLI, Cursor, Kiro, and any MCP-compatible client) query your telemetry directly. No local server, no infra to run, no agent process to maintain — just point your client at the regional endpoint and authenticate. ### Endpoints - US region: `https://mcp.us.bronto.io/mcp` - EU region: `https://mcp.eu.bronto.io/mcp` Use the endpoint that matches the data region of your Bronto account. Connecting to the wrong region returns an authentication error. ### Authentication Two supported modes: 1. **OAuth 2.0** (recommended for interactive clients). The MCP client opens a browser, the user signs in with any login method enabled by their admin (OAuth, SSO, or Google Social), approves scopes, and Bronto redirects an access token back to the client. Token refresh is automatic. Admins control which login methods are permitted for MCP via the Authentication settings page, giving fine-grained control over who can connect. 2. **API key** via the `X-BRONTO-API-KEY` request header. Useful for stdio-only clients (bridged through `mcp-remote`) and for clients that support `streamable-http` transport with custom headers natively (e.g. Kiro). Required transport headers: `Accept: application/json, text/event-stream` and `Content-Type: application/json`. ### Example client configs Claude CLI: ``` claude mcp add --transport http bronto https://mcp.eu.bronto.io/mcp && claude ``` mcp-remote bridge for stdio clients (Claude Desktop with API key): ```json { "mcpServers": { "bronto-eu": { "command": "npx", "args": ["mcp-remote", "https://mcp.eu.bronto.io/mcp", "--header", "X-BRONTO-API-KEY:${AUTH_TOKEN}"], "env": { "AUTH_TOKEN": "" } } } } ``` Direct streamable-http (Kiro and similar): ```json { "mcpServers": { "bronto-us": { "type": "streamable-http", "url": "https://mcp.us.bronto.io/mcp", "headers": { "Accept": "application/json, text/event-stream", "X-BRONTO-API-KEY": "" } } } } ``` ### Tools exposed The hosted MCP server exposes seven tools that cover schema discovery through raw search and aggregated analytics. A typical agent workflow walks them in order: discover datasets → inspect schema → build filters → search or aggregate. - `get_datasets` — list every dataset the caller can access (name, collection, ID, tags). Discovery starting point. - `get_datasets_by_name` — resolve a dataset by exact name + collection. - `get_all_datasets_keys` — return field names across every accessible dataset; useful for cross-dataset schema scanning. - `get_keys` — return field names for a specific dataset. - `get_key_values` — return common values for a field in a dataset; used to build precise filters. - `search_logs` — search raw log events across one or more datasets over a time range, with filters, limits, and sorting. Best for investigations and event-level troubleshooting. - `timeseries` — aggregated metrics and time-series trends (COUNT, SUM, AVG, percentiles, grouping, time bucketing, comparison windows). Best for summaries and trend analysis. ### What this unlocks With the hosted MCP server connected, an AI assistant can answer operational questions in natural language against live telemetry — for example: *"Which datasets contain production CDN logs?"*, *"In the last 30 minutes, find elevated 5xx responses grouped by host, path, and status code"*, or *"Compare CDN response-time metrics for the last hour vs the previous hour and identify the largest regressions."* The agent uses dataset discovery first to scope correctly, then narrows to specific fields and time windows. ### Operational notes - Nothing to install or run locally. The only optional local component is `mcp-remote`, a lightweight `npx` bridge for stdio-only clients. - Same access controls as the rest of Bronto — disabling a login method for MCP blocks users who rely on it. - Tokens never need to be hardcoded; use environment variables for API keys. --- ## Pricing (/pricing) Bronto uses a transparent ingestion + tiered-search model. The headline number is **$0.10/GB ingested**. Search is tiered (20x to 100x of ingestion included on standard plans, with predictable overage rates). 12 months of always-hot retention is included on every plan. What you do **not** pay for separately: - Per-host fees - Per-seat fees — give the whole team access at the same price - Indexing fees on top of ingestion - Custom metrics or high-watermark surcharges - Storage tiers, archives, or rehydration - AI features (Bronto Scope is included) Plans scale by ingestion volume. Annual billing available. Custom enterprise pricing for petabyte-scale workloads. --- ## Comparisons Bronto publishes detailed competitive battlecards. Each follows the same structure: positioning, pricing model differences, retention defaults, search performance, and a feature-by-feature table. ### Bronto vs Datadog (/compare/datadog) **Tagline:** Surprise bills and high ingestion costs are forcing teams to consider Datadog alternatives. With Bronto, you can retain all of your logs and traces in one place with full fidelity and sub-second queries. - **Datadog pricing:** per-host + $0.10/GB ingest + $1.70/M indexed + custom metrics - **Bronto pricing:** ingestion-only, one number - **Datadog retention:** 15 days hot default, archive extra, rehydration required - **Bronto retention:** 12 months always-hot included - **Datadog AI:** Watchdog, premium tier - **Bronto AI:** Bronto Scope, included - **Signal:** Datadog log bills grow 30–50% YoY. Mid-size teams spend $50K–$150K/yr; enterprise can exceed $1M once APM, logs, and RUM stack up. - **Position:** Drop Bronto in alongside Datadog APM and infrastructure. Move logs over for predictable ingestion-only pricing and 12 months of always-hot retention. ### Bronto vs New Relic (/compare/new-relic) **Tagline:** Give every engineer access to logs without the per-seat penalty. - **New Relic pricing:** CCU + $99–$400/user/mo seats - **Bronto pricing:** Ingestion-only, no seat tax - **Search:** Free in Bronto vs CCU consumption in New Relic - **Retention:** 12 months hot in Bronto vs tiered/varies in New Relic - **Signal:** A 50-person team can pay ~$4,950/mo in seats before any data costs. CCUs are consumed by every dashboard refresh, alert evaluation, and AI assistant query. - **Position:** Keep New Relic for APM, move logs to Bronto, slash total spend. ### Bronto vs Elastic / ELK (/compare/elastic) **Tagline:** ELK can be powerful, but it requires ongoing configuration and costly maintenance. With Bronto, everything is fully managed at scale with fast search and built-in tracing. - **ELK cost reality:** servers + storage + networking + backup + dedicated SRE time - **Bronto:** fully managed, zero ops overhead - **Setup time:** minutes for Bronto vs days/weeks for ELK - **Search performance:** sub-second on TBs guaranteed in Bronto vs depends-on-cluster-tuning for ELK - **Tracing:** native in Bronto, separate tool for ELK - **Signal:** Self-managed ELK requires dedicated DevOps/SRE time. Loaded engineering cost often dwarfs the software bill. - **Position:** Search power of ELK, none of the ops. ### Bronto vs Sumo Logic (/compare/sumo-logic) **Tagline:** Sumo Logic works well for security and compliance workflows, but it wasn't built for the AI era. With Bronto, centralize logs and traces for petabyte scale with 12-month retention and predictable pricing. - **Sumo pricing:** Credit-based across logs, metrics, traces, and storage at different rates - **Bronto pricing:** One transparent monthly price - **Sumo retention:** Depends on policy configuration - **Bronto retention:** 12 months included - **Sumo parsing:** Manual Grok/regex for unsupported schemas - **Bronto parsing:** AI-native, automatic - **Signal:** Credit-based pricing makes forecasting nearly impossible. Renewal windows are prime displacement moments. ### Bronto vs Logz.io (/compare/logz-io) **Tagline:** Logz.io offers limited retention at a high ingestion price. Bronto solves logging and tracing with more reliable performance and a lower price. - **Logz.io price:** ~$0.92/GB ingested - **Bronto price:** $0.10/GB ingested - **Logz.io retention:** 7 days default - **Bronto retention:** 12 months always-hot - **Signal:** Logz.io retains logs for only 7 days by default. One audit or slow-burn incident exposes the gap. ### Bronto vs Grafana Loki (/compare/grafana-loki) **Tagline:** Loki is easy to start with for Grafana workflows, but has serious limits at scale. Bronto collects full telemetry and runs sub-second queries on one platform. - **Loki indexing:** Labels only (15 per series), does not index log line content - **Bronto indexing:** Full-fidelity, no cardinality ceiling - **Loki price:** $0.50/GB at 30-day retention - **Bronto price:** $0.10/GB ingestion with 12 months retention - **Position:** Keep your Grafana dashboards. Pipe full-fidelity logs and traces into Bronto. ### Bronto vs AWS CloudWatch (/compare/aws-cloudwatch) **Tagline:** Collect logs and traces from any source in one platform with long-term retention and sub-second queries. - **CloudWatch pricing:** $0.50/GB ingest + $0.05/GB scanned (Insights) + storage - **Bronto pricing:** $0.10/GB ingest, no extra storage fees, tiered search - **CloudWatch tracing:** Requires X-Ray or ADOT as a separate setup - **Bronto tracing:** Built-in with log-to-trace and trace-to-log correlation - **CloudWatch scope:** AWS-only - **Bronto scope:** Multi-cloud, schema-agnostic, any source - **Signal:** 15+ billing dimensions. Mid-size Kubernetes clusters can exceed $10K/mo. Teams underestimate spend by 2x–4x. --- ## Security (/security) Bronto is built to enterprise security standards. **Compliance:** SOC 2 Type II, ISO 27001, GDPR, CCPA, PCI-DSS aligned. **Data security measures:** - Encryption in transit (TLS 1.2+) and at rest (AES-256) - Tenant isolation at the storage and query layer - Annual third-party penetration testing - Audit logging for all administrative actions - Optional EU and US data residency **Access controls:** - SSO via SAML 2.0 (Okta, Azure AD, Google Workspace, etc.) - Role-based access control (RBAC) with custom roles - Multi-factor authentication required for all users - Fine-grained permissions on data, dashboards, alerts, and saved views - API key management with scoped permissions --- ## Company (/about) Bronto was founded by engineers who lived through the pain of legacy observability bills, slow searches, and rip-and-replace migrations. The company is headquartered in Europe with EU data residency available by default. **Mission:** Make full-fidelity telemetry — logs, traces, and metrics — affordable, fast, and useful at any scale. **Why "Bronto":** Big data, kept safe and accessible. **Hiring:** /careers **Contact:** /contact --- ## Resources - **Blog (/blog)** — Engineering, product, and observability deep dives. - **Articles (/resources/articles)** — Long-form guides on telemetry, observability, OpenTelemetry, log management, and incident response. - **Customer stories (/customer-stories)** — How teams use Bronto in production, including migration narratives from Datadog, Splunk, ELK, and CloudWatch. - **Release notes (/release-notes)** — Latest product updates and improvements, published regularly. - **Brand (/brand)** — Logos and brand assets. - **Book a demo (/book-demo)** — Schedule a personalized walkthrough with the team. - **Free trial** — https://app.eu.bronto.io/signup --- ## Common questions **Does Bronto replace Datadog or New Relic entirely?** For logs and traces, yes. Most teams keep their existing APM (Datadog APM, New Relic APM) and move logs to Bronto for the predictable pricing and 12-month retention. Bronto also handles distributed traces natively if you're consolidating. **How does the migration work?** Point your existing agents (OpenTelemetry, Fluent Bit, Fluentd, Vector, Datadog Agent forwarders, AWS Firehose, etc.) at Bronto. No code changes required. Most teams run a parallel POC in under two weeks. **What's included in the price?** Ingestion, 12 months always-hot retention, tiered search, AI parsing, Bronto Scope investigations, all integrations, all users, all dashboards, all alerts. No premium tiers for core features. **What about data residency?** EU and US regions available. Customer data never leaves the chosen region. **Is there a free tier?** A free trial is available at https://app.eu.bronto.io/signup. --- ## Legal - Privacy Policy (/privacy-policy) - Terms of Service (/terms) - Cookie Policy (/legal/cookies) ## Blog posts - [Bronto Raises $14M Seed Round and Introduces the World's Most Powerful Log Data Platform - Built for the AI Era](https://bronto.io/blog/announcing-our-14m-seed-fundraising): Industry veterans return with a fully hosted log management platform built for the AI era, promising low latency, large scale, and long term retention at a fra… - [Building on Vercel? Your observability data now have a better home](https://bronto.io/blog/building-on-vercel-your-logs-now-have-a-better-home): Vercel is one of the breakout stories of the AI boom. From being a scrappy deployment tool on launch ten years ago, it is now the platform of choice for over 6… - [How to use MCP agents to access multiple data stores](https://bronto.io/blog/how-to-use-mcp-agents-to-access-multiple-data-stores): This blog is the second of a three part series on the Agent2Agent (A2A) protocol and agentic querying of data. It will demonstrate how easy it is to create two… - [How To Use A2A to Access Multiple Data Stores](https://bronto.io/blog/how-to-use-a2a-to-access-multiple-data-stores): This blog is the third of a three part series on Agents and particularly the Agent2Agent (A2A) protocol. It will build on the two previous posts, Introduction… - [Introduction to A2A and agent search](https://bronto.io/blog/introduction-to-a2a): AI is rapidly evolving from the early simple tools to increasingly complex agents able to perform reasoning and decision making. As these agents are used for m… - [Data Organization in Bronto: How We Keep Searches Fast Without Making You Think About It](https://bronto.io/blog/data-organization-in-bronto): Every logging platform has to solve the same fundamental problem: when a query arrives, how do you avoid scanning data you don't need? The answer determines yo… - [Bring your own (Telemetry) UI using Lovable & Bronto](https://bronto.io/blog/brontovibe): The Bronto REST API now exposes everything our own UI is built on. That means you can build a custom interface tailored exactly to your team's workflow, rather… - [Investigation Reports: When Monitors Get Smarter](https://bronto.io/blog/investigation-reports-when-monitors-get-smarter): Typically, when a monitor fires, there are a sequence of checks required to find the root cause. The engineers who set up the monitor usually know these steps… - [Linking Logs to Code: Introducing Statement IDs](https://bronto.io/blog/linking-logs-to-code): In this blog post, we introduce the concept of statement IDs and how they can be used in Bronto. A statement ID is a unique identifier assigned to log statemen… - [Using Dashboard Filtering to Get Customer Usage in Seconds from TBs of Data](https://bronto.io/blog/dashboard-filtering-to-get-customer-usage): As the Customer Success lead in Bronto I need fast, reliable insights into customer health and product usage but I don’t have time to constantly update indexes… - [Bronto Logging & Observability Best Practices](https://bronto.io/blog/logging-best-practices): Centralized logging is a good start to improving your log management as it allows collection, storage and analysis from multiple sources in a single repository… - [Your LLM Logs Deserve Better · Send Them to Bronto](https://bronto.io/blog/sending-logs-from-claude-code-to-bronto): In this post, we’ll walk through how to integrate Anthropic’s Claude Code monitoring with Bronto so you can get a clear, unified view of your usage — all in on… - [Why we ran an AI Sprint not an AI Hackathon](https://bronto.io/blog/why-we-ran-an-ai-sprint-not-an-ai-hackathon): Recently our CEO came to me and said “Why don’t we do a hackathon on AI so the team can further immerse themselves into building with the latest AI tools and g… - [Building Dashboards with AI](https://bronto.io/blog/building-dashboards-with-ai): At Bronto we have been working on different ways to integrate AI into our product. Given the rate of progress with LLMs over the past few years it’s becoming e… - [Bronto MCP Server](https://bronto.io/blog/bronto-mcp-server): With the rise of agentic workloads, the need for agents to access data is growing rapidly. MCP has emerged as the standard for equipping agents with the necess… - [Naming Is Hard… Except at Bronto](https://bronto.io/blog/naming-is-hard-except-at-bronto): There are 2 hard problems in computer science: cache invalidation, naming things, and off-by-1 errors. -- Leon Bambrick - [The 4L’s of Logging - the New Standard for the AI era](https://bronto.io/blog/the-4ls-of-logging): Traditionally in the world of logging it was said there were 3Ls - low cost, low latency and large scale - and end users would have to compromise by choosing 2… - [BrontoScope: AI-powered error investigations](https://bronto.io/blog/error-investigations-with-brontoscope): Today we are introducing BrontoScope, which is one of the Bronto AI Labs initiatives to reduce user toil, increase team efficiency and reduce MTTR. - [Log Parsing with AI at Bronto](https://bronto.io/blog/log-parsing-with-ai): This post follows on from our AWS Nova log benchmarking article, where we explored how smaller LLMs like Nova Micro perform on log analysis tasks compared to l… - [Logging your AI events (from Ollama) in Bronto](https://bronto.io/blog/logging-events-from-ollama): Many software companies, including logging platform providers, are investigating the use of Large Language Models (LLMs) in their products and some have embedd… - [Benchmarking AWS Nova on Log Data: How It Compares to ChatGPT-3.5](https://bronto.io/blog/benchmarking-aws-nova): This post explores the use of large language models (LLMs) for analyzing log data. To do so, we reproduced part of the An Assessment of ChatGPT on Log Data ben… - [The Log Management Cost Trap: Part III - Search](https://bronto.io/blog/cost-trap-search): In Part I (Ingestion) and Part II (Storage) of our Log Management Cost Trap series, I explored the challenges of designing, running and managing a centralised… - [Introducing Bronto Labs: AI That Actually Solves Real Problems](https://bronto.io/blog/introducing-bronto-labs): We've been saying for a while now that logging is fundamentally broken. But here's what really gets under my skin: the so-called "AI revolution" in observabili… - [Why ClickHouse fails as a general-purpose logging solution](https://bronto.io/blog/why-clickhouse-fails): Let's talk about ClickHouse. It's fast, it's efficient, it's open source. But it’s designed to be a general purpose analytical database, which makes it challen… - [Why is Bronto so fast at searching logs?](https://bronto.io/blog/why-is-bronto-so-fast): As we shared in a recent post, one of the main reactions we got at Kubecon Europe was about how quick our log search is. That post includes some internal bench… - [The CDN Logging Crisis](https://bronto.io/blog/the-cdn-logging-crisis): Every second, your content delivery network is generating thousands of logs that tell a critical story about your application's performance, security, and user… - [The Log Management Cost Trap: Part II - Storage](https://bronto.io/blog/cost-trap-storage): In Part I of our Log Management Cost Trap series, I explored the challenges of designing, running and managing a centralised log management solution, with a fo… - [Breaking Logging’s Flywheel of Compromises](https://bronto.io/blog/breaking-the-flywheel-of-compromises): Let's face it - logging is broken. Not just a little broken, but fundamentally misaligned with the needs of modern engineering teams. At our recent AWS Summit… - [KubeCon Europe: Where "Wow, that was fast!" became our unofficial tagline](https://bronto.io/blog/wow-that-was-fast): Bronto officially exited stealth mode recently when we made our first-ever public appearance at KubeCon Europe. Thankfully, the experience validated much of wh… - [The Log Management Cost Trap: Ingestion](https://bronto.io/blog/cost-trap-ingestion): In this post, I’m going to explore the challenges of designing, running, and managing a centralised log management solution. Centralised logging systems collec… - [Bronto for Fastly: Real-time CDN logging that actually scales](https://bronto.io/blog/bronto-for-fastly): A company processing 10s of TBs of Fastly logs daily through traditional logging vendors faces an impossible choice: pay enterprise prices for comprehensive lo… - [Making Sense of Log Noise at Scale: Introducing Patterns](https://bronto.io/blog/making-sense-of-log-noise-at-scale-introducing-patterns): Every application produces logs. At low volume, reading those logs is fine, you scroll, you spot the problem, you move on. But as your system grows, logs stop… ## Articles - [Centralizing CDN logs: a guide to high-volume log management](https://bronto.io/resources/articles/centralizing-cdn-logs): What centralised CDN logging actually requires when your providers each generate tens of thousands of log lines per second, and what it takes to keep that data queryable. - [CDN log analytics: a guide to full-fidelity Fastly and Cloudflare logging](https://bronto.io/resources/articles/cdn-log-analytics): The metrics that matter for CDN operations all depend on raw, per-request log rows. Here's why pre-aggregated dashboards fall short and what full-fidelity analytics unlock. - [The CDN observability consolidation guide: replace 5–8 tools with one logging layer](https://bronto.io/resources/articles/the-cdn-observability-consolidation-guide): Most CDN observability stacks accumulated as a series of individually rational decisions, each forced by the cost model of the last platform. Here's how to consolidate them. - [CDN observability at edge scale: why full-fidelity logging requires a different architecture](https://bronto.io/resources/articles/cdn-observability-at-edge-scale): Why traditional observability platforms struggle at CDN log volumes — and why the problem is architectural, not just a pricing issue. - [A framework for CDN logging total cost of ownership](https://bronto.io/resources/articles/cdn-logging-total-cost-of-ownership): A logging platform's true cost at CDN volume is the product of several compounding charges: ingestion, storage, query, rehydration, and operational overhead. Here's how to calculate the real number. - [Querying CDN logs with AI: what you should expect from your logging platform](https://bronto.io/resources/articles/querying-cdn-logs-with-ai): An LLM that generates perfect SQL is still useless if that SQL takes 30 minutes to return. The bottleneck isn't the AI layer — it's the storage and query engine underneath it. - [ELK Stack TCO: what it's really costing you to self-manage](https://bronto.io/resources/articles/elk-stack-tco-what-its-really-costing-you-to-self-manage): Self-managed log infrastructure rarely starts as a strategic choice. The real cost shows up in Slack messages at 2 a.m. and in the post-incident conversation where retention ended right where the evidence should have been. - [Logging on AWS: when CloudWatch stops being enough](https://bronto.io/resources/articles/logging-on-aws-when-cloudwatch-stops-being-enough): CloudWatch is the natural starting point for AWS-native logging. But logging infrastructure has a way of quietly becoming a constraint — in cost, in performance, and in coverage.