Amazon OpenSearch Ingestion vs rsyslog

Amazon OpenSearch Ingestion is a managed, serverless service that streams logs, metrics, and traces to OpenSearch Service domains or OpenSearch Serverless collections. Each pipeline has a source, optional ordered processors, and one or more sinks, including another pipeline as a sink. Processing can filter, enrich, transform, normalize, aggregate, and route structured or unstructured data, including textual, numerical, and geospatial content. AWS automatically scales ingestion workloads and manages installation, patching, version upgrades, continuous monitoring, and repair. Users define YAML pipelines through the AWS Console or CLI, set minimum and maximum ingestion OCU capacity, or pause a pipeline; paused pipelines consume no OCUs. Billing is hourly with per-minute granularity for allocated OCUs, with one OCU providing 15 GB RAM and 2 vCPU. Private connectivity is available through VPC access and PrivateLink, or pipelines can use the public internet. Redaction, obfuscation, conditional routing, and a stated 99.9% availability SLA are included.

rsyslog is a self-hosted engine for collecting, transforming and routing event data, with a processing model built from inputs, rulesets and actions. The project says it can deliver over one million messages per second to local destinations when processing is limited. Reliability features include on-demand disk spooling, backup destinations and multiple processing threads. Documented outputs include Elasticsearch, OpenSearch, Apache Kafka, HTTP endpoints and syslog forwarding. Database outputs cover MariaDB/MySQL and PostgreSQL, with libdbi support for other databases. TLS-protected syslog and forwarding with peer authentication settings are documented. The core programs use GPLv3, while some runtime files use LGPL. rsyslog is developed for Linux, POSIX and related UNIX-like systems, and is available through source, Git, distribution packages and Docker. It does not run natively on Windows; a separate Windows Agent collects Event Logs and local log files and can relay syslog to rsyslog on Linux. The core software is free; paid support is available from €1,999/yr.