How to ingest service logs from other regions to the region I deployed Centralized Logging with OpenSearch console?

[Paul-AWS]

I’d like to collect service logs from multiple regions into the region that i deployed Centralized Logging with OpenSearch console in. I can only list the services in current region when creating a service pipeline, how to ingest logs from other regions?

[Paul-AWS]

We define the region that the services belongs in as “source region”. And define the region that you deployed the Centralized Logging with OpenSearch console in as “logging region”.

For CloudTrail, you can create a new trail which send logs into a S3 bucket that in the logging region. Please refer to Creating a trail document to create a new trail. Then you can find the CloudTrail in the list.

For services whose log location is S3, you can manually transfer logs to logging region S3 bucket, and use Manual Creation Method to ingest logs from source regions.

You can follow the steps below to complete cross-region logs ingestion.

1. Set the log location of other region services to the logging region (such as WAF), or automatically copy logs from source region to logging region using Cross-Region Replication (CRR).
2. In the console, choose the “AWS Service Log” in the left sidebar. Then click the “Create log ingestion” button.
3. In “Select an AWS Service”, choose a service in the list, then click “Next”.
4. In “Creation Method”, choose “Manual”, then fill up the resource name and S3 log location parameter, then click “Next”.
5. Set “OpenSearch domain” and “Log Lifecycle” as need, then click “Next”.
6. Add tags if you need, then click “Create” button to create the pipeline.

Then you can use the OpenSearch dashboard to discover logs and view dashboards.