OpenSearch domain error logging to CloudWatch Logs should be enabled

How to fix it

In the console

OpenSearch Service → Domains → the domain → Logs

Error logs

Enabled

CloudWatch log group

A new log group, or an existing one kept for this domain's error logs

Access policy

One letting es.amazonaws.com call logs:CreateLogStream and logs:PutLogEvents on the log group

With the AWS CLI

aws opensearch update-domain-config --domain-name <domain-name> --log-publishing-options 'ES_APPLICATION_LOGS={CloudWatchLogsLogGroupArn=<log-group-arn>,Enabled=true}' --region <region>

With Terraform

• Overwrites existing settings: log_publishing_options blocks are the domain's whole set in Terraform, so a log type left out is turned off; keep a block for every log already published.

resource "aws_opensearch_domain" "this" {
  domain_name = var.domain_name

  log_publishing_options {
    log_type                 = "ES_APPLICATION_LOGS"
    cloudwatch_log_group_arn = var.log_group_arn
  }
}