Question

A CloudOps engineer needs to stream application log events from a CloudWatch Logs log group to an Amazon OpenSearch Service domain in near real time so the team can build searchable dashboards. Only log entries containing the string "ERROR" should be delivered to reduce indexing costs. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs subscription filter with a filter pattern matching "ERROR" that delivers matching events to the OpenSearch Service domain.

Answer

Create a CloudWatch Logs metric filter for "ERROR" and configure an alarm that publishes to an SNS topic subscribed to OpenSearch.

Answer

Schedule a Lambda function every 5 minutes to call FilterLogEvents, filter for "ERROR", and index results into OpenSearch.

Answer

Export the log group to Amazon S3 on a daily basis and use an OpenSearch ingestion pipeline to load and filter the objects.