aws-samples / siem-on-amazon-opensearch-service

A solution for collecting, correlating and visualizing multiple types of logs to help investigate security incidents.
MIT No Attribution
567 stars 185 forks source link

Unable to ingest logs due to cold storage config #346

Closed pnwstevan closed 1 year ago

pnwstevan commented 1 year ago

Greetings,

This is pretty awesome, but I've been unable to actually ingest any log data due to the following error from AWS OpenSearch in CloudWatch logs:

Rejecting request because cold storage is not enabled on the domain. Enabling cold storage for the first time can take several hours. Please try again later.

Not sure if this was a breaking change on the AWS OpenSearch service side, but I've tried this deployment multiple times with the same outcome in the following configs:

Any thoughts/ideas? Seems like getting cold storage enabled also requires UltraWarm and a bunch of extra nodes which isn't ideal for a trial/lab setup.

Thanks!