Configure A Cloud Watch Subscription Filter To Send Logs To Specific AWS Open Search Index Alias

Hi,

You can update the code of the Lambda that was automatically created to send the logs to Open Search.

Look at https://repost.aws/knowledge-center/opensearch-stream-data-cloudwatch It is for another use case: cross-account Open Search indexing but sections "Set up CloudWatch Logs in Account A" and "Configure Lambda in Account A" apply to your use case. Use this second section up to step #3 and modify the code to reach to use your index alias instead of initial generated index.

Best,

Didier

Thanks for the suggestion but the linked article did not cover my use case. After a further review of the Lambda function code that is created by subscription filter it was the indexname variable that needed to be changed. The default code (line 63-67) is this:

var indexName = [
            'cwl-' + timestamp.getUTCFullYear(),              // year
            ('0' + (timestamp.getUTCMonth() + 1)).slice(-2),  // month
            ('0' + timestamp.getUTCDate()).slice(-2)          // day
        ].join('.');

In order to send the logs to an AWS Open Search index alias I modified the code to this:

var indexName = 'index-alias';

After this change I was successfully able to ingest logs to my required index.