Question

A company runs a centralized logging platform on an Amazon OpenSearch Service domain with hot data nodes storing 90 days of application and infrastructure logs. Compliance requires that logs be retained and remain searchable for 2 years, but analysts only query the last 14 days for active troubleshooting; older data is queried rarely and can tolerate multi-second retrieval latency. The current all-hot configuration has become the largest line item in the monthly bill. A solutions architect must reduce storage cost while preserving the 2-year searchable retention with the least ongoing operational overhead. Which approach best meets these requirements?

Accepted Answer

Configure UltraWarm storage for data older than 14 days and cold storage for data older than 90 days, and use Index State Management (ISM) policies to automate the transitions and enforce the 2-year retention.

Answer

Reduce the hot node instance sizes and enable EBS gp3 volumes with lower provisioned IOPS to shrink storage cost while keeping all 2 years of logs on hot nodes.

Answer

Create daily snapshots to Amazon S3 and delete indices older than 14 days from the domain, restoring snapshots manually into a temporary domain whenever older logs must be queried.

Answer

Stream all logs to Amazon S3 with Kinesis Data Firehose, delete the OpenSearch domain, and use Amazon Athena for all queries against the log data.