An application writes JSON events to CloudWatch Logs with a severity field. The on-call team must receive an SNS notification when at least five events with severity ERROR arrive in a five-minute period. Which configuration meets this requirement with the least operational effort?

1. Use the Average statistic on a metric that emits 1 per ERROR event and set its threshold to 5.
2. Create a log metric filter that emits 1 for every log entry, regardless of severity, and alarm on its Sum.
3. Create a metric filter matching ERROR events, emit a value of 1 for each match, and alarm on the five-minute Sum with an SNS action.
4. Create a Logs Insights query and rely on saving the query to send SNS notifications automatically.