Log classes
CloudWatch Logs offers two classes of log groups:
CloudWatch Logs Standard log class is a full-featured option for logs that require real-time monitoring or logs that you access frequently.
CloudWatch Logs Essentials log class (formerly Infrequent Access) is a log class that you can use to cost-effectively consolidate your logs. This log class offers a subset of CloudWatch Logs capabilities including managed ingestion, storage, cross-account log analytics, and encryption with a lower ingestion price per GB. The Essentials log class is ideal for ad-hoc querying and after-the-fact forensic analysis on infrequently accessed logs.
Note
For charges, the Standard and Essentials (formerly Infrequent Access) log classes differ in ingestion costs only. Storage charges and CloudWatch Logs Insights charges are the same in each log class.
For more information about CloudWatch Logs pricing, see Amazon CloudWatch Pricing
Important
After a log group is created, its log class can't be changed.
The Infrequent Access log class has been renamed to
Essentials. You can now create log groups with either
INFREQUENT_ACCESS or ESSENTIALS as the log class value.
Both values are accepted as input and will continue to be supported indefinitely.
Starting December 2026, API responses from
DescribeLogGroups, ListLogGroups, and other read-path APIs
will return ESSENTIALS instead of INFREQUENT_ACCESS for the
logGroupClass field. This is a name change only. There are no changes to
functionality or pricing.
Supported features
The following table lists the features for each log class.
| Feature | Standard | Essentials (formerly Infrequent Access) |
|---|---|---|
|
Fully managed log ingestion and storage |
Yes ✓ |
Yes ✓ |
|
Yes ✓ |
Yes ✓ |
|
|
Yes ✓ |
Yes ✓ |
|
|
Yes ✓ |
Yes ✓ (Most commands– see Logs Insights QL commands supported in log classes.) |
|
|
Yes ✓ |
Yes ✓ |
|
| Facets |
Yes ✓ |
No |
| Using CloudWatch Pipeline to transform logs |
Yes ✓ |
Yes ✓ |
|
Yes ✓ |
Yes ✓ |
|
| S3 Tables Integration |
Yes ✓ |
Yes ✓ |
| Scheduled Queries |
Yes ✓ |
Yes ✓ |
|
Using OpenSearch PPL or OpenSearch SQL to query in CloudWatch Logs Insights; |
Yes ✓ |
Yes ✓ |
| Natural language query assist |
Yes ✓ |
No |
|
Yes ✓ |
No |
|
|
Yes ✓ |
No |
|
|
Yes ✓ |
No |
|
|
Yes ✓ |
No |
|
|
Yes ✓ |
No |
|
|
GetLogEvents and FilterLogEvents API operations |
Yes ✓ |
Not supported. Use CloudWatch Logs Insights to view log events stored in log groups in the Essentials (formerly Infrequent Access) log class. |
|
Yes ✓ |
No |
|
|
Yes ✓ |
No |
|
|
Yes ✓ |
No |
|
|
Yes ✓ |
Yes ✓ |
|
|
Yes ✓ |
No |
Note
In addition to these two log classes, there is a Delivery log class. Use the Delivery log class only for delivering AWS Lambda logs to store in Amazon S3 or
Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for two days. This retention period is fixed and cannot be changed. This log class doesn't offer rich CloudWatch Logs capabilities such as
CloudWatch Logs Insights queries.
