Configuration for CloudWatch Subscription Filter. Streams log events to destinations in real-time. **Common Destinations:** - Lambda functions (for log processing) - Kinesis streams (for log aggregation) - Kinesis Firehose (for S3 archival) - OpenSearch (for log analytics) **Production Use Cases:** - Stream logs to centralized logging (ELK, Splunk) - Real-time log processing and alerting - Security event monitoring (SIEM integration) - Compliance log archival **Best Practices:** - Use filter patterns to reduce unnecessary data transfer - Consider costs for high-volume log streaming - Set appropriate IAM permissions for destinations - Monitor subscription filter delivery failures