Can we set CloudWatch logs as source for OpenSearch ingestion pipeline?

Per my info . No !! OpenSearch Ingestion pipelines are designed to ingest data from various sources like SQS queues, Kafka topics, and Amazon S3 buckets. Cloud Watch logs aren't included in this list.

Workaround: Leverage Data Firehose as an intermediary

1/ CloudWatch for log collection and filtering.

2/ Data Firehose for buffering, transformation (optional), and delivery to S3.

3/ SQS for triggering the OpenSearch Ingestion pipeline based on new log arrivals in S3.

4/ OpenSearch Ingestion for data processing and delivery to your OpenSearch Serverless collection.