Question

A company runs dozens of microservices across multiple accounts, each writing to its own CloudWatch Logs log groups. The security team wants near-real-time streaming of all application logs into a centralized Amazon OpenSearch Service domain in a dedicated logging account, so analysts can query recent events within seconds of them being generated. The solution must scale to hundreds of log groups and require minimal ongoing operational effort. Which approach best meets these requirements?

Accepted Answer

Create a CloudWatch Logs subscription filter on each log group that streams to a Kinesis Data Streams stream in the logging account (via a cross-account destination), then use a Lambda or Firehose consumer to deliver records to the OpenSearch domain.

Answer

Schedule an hourly CloudWatch Logs Insights query in each account and export the results to an S3 bucket in the logging account, then load the files into OpenSearch with a nightly batch job.

Answer

Enable the CloudWatch Logs export-to-S3 task on each log group on a recurring basis, then configure S3 event notifications to trigger a Lambda that indexes the objects into OpenSearch.

Answer

Configure a CloudWatch metric filter on each log group to publish a custom metric, then create an EventBridge rule that forwards the metric data to OpenSearch in the logging account.