A company stores application logs in an Amazon CloudWatch Logs log group. A new policy requires storing all application logs in Amazon OpenSearch Service (Amazon Elasticsearch Service) in near-real time. Which solution achieves this with the LEAST operational overhead?

The most straightforward and lowest operational overhead solution is to configure a CloudWatch Logs subscription filter. This allows you to stream logs directly from CloudWatch Logs to an Amazon OpenSearch Service domain in near real-time. This built-in integration requires minimal setup and management. Creating an AWS Lambda function involves writing and maintaining custom code, increasing operational overhead. While feasible, it's not the simplest option. Using Amazon Kinesis Data Firehose is also a valid solution for streaming to OpenSearch, but it introduces an additional service (Firehose) between CloudWatch Logs and OpenSearch, making the CloudWatch Logs subscription filter a more direct and simpler approach for this specific scenario. Installing Kinesis Agent on each application server is the most complex solution, requiring agent installation, configuration, and management on every server, significantly increasing operational overhead.