An API writes JSON access logs to CloudWatch Logs. During an incident, an engineer needs the ten request paths with the highest count of HTTP 500 responses over the last hour. No permanent dashboard or alert is required. Which tool is the most direct fit?

1. Run a CloudWatch Logs Insights query that filters status 500, groups by request path, counts events, and sorts the results.
2. Create a new alarm for each possible URL and wait for the next hour of traffic.
3. Read the ALB aggregate HTTPCode_Target_5XX_Count metric and assume it identifies every request path.
4. Export the hour of logs to S3, configure a query table, and run an Athena aggregation.