requirements

add this code to your custom field in serverless

custom:
    ...
    stage: ${opt:stage, self:provider.stage}
    esLogs:
        endpoint: search-smartagent-monitoring-logs-xjyu2rqhj3wecill7g7tfwhx7e.eu-west-2.es.amazonaws.com
        index: logs-${self:custom.stage}
        filterPattern: '[timestamp=*Z, request_id="*-*", level=ERROR || level=WARN || level=INFO || level=DEBUG , event ]'
        tags:
            stage: ${self:custom.stage}

and this to your plugin list:

    - serverless-es-logs

add an IAM Policy to your stack to allow the ES Logs function to post logs to ES in a seperate account

provider:
    name: aws
    runtime: nodejs12.x
    region: eu-west-2
    stage: ${opt:stage, 'dev'}
    iamRoleStatements:
    - Effect: 'Allow'
      Action:
        - es:ESHttpPost
      Resource: arn:aws:es:eu-west-2:071616078950:domain/smartagent-monitoring-logs/*