Cloudwatch Dashboard - Best practice for use and cost

Good afternoon. I have a server the sends logs to a log-stream and I wish to have 3 graphs with a count of WARNING, ERROR and CRITICAL. I did a multi-dimension query, separated and things worked perfect, the issue is after 3 hours it dropped off (then I noticed the query past 3 hour message) so I can't do that.

So looking around I see the widget option to use Logs as a source. From there I can pick that stream, but the query process looks a bit much, I want to say here is the source, find that string and count those. Before I take on that task of learning, will I be hit with the same limit?

I want to have an ongoing line graph showing the counts, a cloudwatch alert if a threshold is met, I know they charge for custom metrics AND I can really use this type of logic for others if I can use the logs, query on the fly and keep that count going.

Thanks all.