A web application on EC2 streams logs to CloudWatch Logs. The company must receive an SNS notification when application error messages exceed a defined threshold within a 5-minute window. Which solution accomplishes this?

The correct solution involves using CloudWatch Logs' native capabilities. A CloudWatch Logs metric filter can extract specific patterns (like "error") from log events and transform them into numerical CloudWatch metrics. Once a custom metric is created, a CloudWatch alarm can be set on this metric. The alarm can then be configured to trigger an SNS notification when the metric (representing the count of errors) exceeds a specified threshold within a defined period (e.g., 5 minutes). Modifying the application to stream directly to SNS is inefficient and bypasses the robust log management features of CloudWatch Logs. Adding a subscription filter to a log group can forward logs to other services, but it doesn't inherently provide the aggregation and thresholding capabilities needed for this specific problem without additional services. Amazon Inspector is a security assessment service, not a log monitoring and alerting service for application errors.