OpenSearch (Elasticsearch) error logs disabled

Logging and monitoring

OpenSearch (Elasticsearch) error logs disabled

Risk Level

Informational (4)

Platform(s)

Compliance Frameworks

AWS Foundational Security Best Practices Controls
HITRUST
NIST 800-53

Description

Amazon OpenSearch Service (Amazon Elasticsearch Service successor) is a managed service that simplifies the deployment, operation, and scaling of OpenSearch clusters in AWS Cloud. It was found that the OpenSearch (Elasticsearch) domain {AwsElasticSearch} doesn't have error logs enabled. Error logs can assist in troubleshooting, repairing, and security issues related to the Elasticsearch domain.

Recommended Mitigation

It is recommended to enable error logging at the OpenSearch (Elasticsearch) domain {AwsElasticSearch}. To enable the audit logging follow the steps at: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html#createdomain-configure-slow-logs-console

OpenSearch (Elasticsearch) error logs disabled

Description

Need help?