Single service comparison

CloudWatch Logs uses a two-level model of log groups (retention, access control, KMS encryption) and log streams (sequence of events from a source), queried with CloudWatch Logs Insights or the metric-filter syntax and surfaced through CloudWatch alarms. Huawei Log Tank Service (LTS) uses log groups plus log streams but separates ingestion (ICAgent, API, or 40+ native cloud-service integrations) from query through SQL-based syntax and dashboards; alerting runs inside LTS rather than being delegated exclusively to a separate alarm service. APIs, SDK calls, and field semantics are not interchangeable, so client code and IaC must be rewritten, not re-pointed.

Scaling and operational ownership differ. CloudWatch Logs is a regional, fully managed, serverless ingestion and query backend with retention configured per log group and cross-account/cross-region views through log ingestion destinations and resource policies. LTS is likewise managed and auto-scaling with cold/hot tiered storage and transfer to OBS, DMS, or DWS, but its first-class integrations are Huawei services (ELB, VPC, CTS, WAF, AOM, APM, CES); AWS service integrations have no native equivalent and must be re-collected. Shipping, audit, and compliance pipelines built on CloudWatch Subscriptions, Kinesis, Lambda, or OpenSearch must be rebuilt around LTS transfer, OBS, DMS, and FunctionGraph equivalents.

Alerting and identikit scope diverge. In AWS, metric filters and Logs Insights drive CloudWatch alarms and dashboards within the CloudWatch console, while CloudWatch Logs Insights queries are billed alongside ingestion and storage. LTS bundles keywords/SQL alarms and dashboards inside the same product, with notifications via SMS, email, and HTTP/DingTalk/WeCom. CES remains the primary metric-alarm service for platform metrics, so a CloudWatch-visible log-derived alarm may need an LTS alarm plus a CES (or AOM) alarm to preserve parity; expect to converge alert topology rather than map one alarm to one.

Assess scope per log group: source (application, ECS-hosted, AWS service, on-prem), volume, retention, encryption, alert rules, and downstream consumers (Kinesis/Lambda/OpenSearch, third-party SIEM). Decide target distribution: AWS application logs map to LTS log groups with ICAgent or the LTS ingestion API; platform metrics and service events map to CES/AOM rather than LTS. Record CloudWatch Logs Insights queries and directory destination patterns as a baseline; LTS does not run CloudWatch query syntax, so each query must be re-expressed in LTS SQL.

Provision LTS log groups and log streams mirroring CloudWatch groups/streams where it aids operational continuity; attach retention, tagging, and IAM-equivalent access policies. Deploy ICAgent on Huawei ECS or ECS-hosted compute, or send through the LTS API/SDK for cross-cloud and device logs; for AWS-native service logs (ELB, VPC, CTS analogues), enable the Huawei service's one-click LTS ingestion rather than re-shipping. Recreate metric filters and Logs Insights queries as LTS SQL queries and alarm rules; move encryption to Huawei KMS and storage tiers to LTS cold/hot storage plus OBS transfer for long-term or audit retention.

Backfill historical logs from S3 or OpenSearch exports to LTS (or keep the warm copy in OBS) so query continuity is not lost, but validate against the original CloudWatch insights outputs field-by-field because field names, timestamps, and JSON flattening differ. Validate alert latency, notification channels, and dashboard query performance under peak load, then cut over ICAgent and API endpoints; freeze new writes to CloudWatch and run dual ingestion briefly before decommissioning. Confirm region availability of LTS in each Huawei region you target, since feature parity and integrated service log sources vary by region.

Mind the cost and contract gaps. AWS typically bills telemetry ingestion, storage, Logs Insights query volume, and alarm evaluations per rule; Huawei LTS bills ingestion, read/write, indexing, storage, and analysis volume plus alarm notifications, often with a free tier (for example, 500 MB/month read/write/index/storage on the international site). Recompute TCO with peak daily ingestion, query concurrency, retention horizon, cross-region/cross-cloud transfer, and SMS/HTTP alarm volume before committing; treat Huawei migration services (such as MgC or equivalent assessment tooling) only as documented for telemetry migration, not as a one-click CloudWatch Logs path.