Both methods, with log_line_prefix configured, produce log lines that answer:
- Who —
%u(authenticated session user at connect time) - When —
%m(timestamp with ms) - What — full SQL text
- From where —
%h(client IP)
Both write to the same PostgreSQL log stream. Both require enabled_cloudwatch_logs_exports = ["postgresql"] to ship