OpenSearch

Amazon OpenSearch Service is the managed search and analytics service that succeeded Amazon Elasticsearch Service. OpenSearch itself is an open-source fork of Elasticsearch, taken at 7.10 — the last open-source release — and developed independently since.

The service provisions and runs clusters for you. A domain is the AWS-level name for a cluster; each instance in it is a node. AWS replaces failed nodes, takes automated snapshots, and lets you resize with an API call.

Dashboards, not Kibana

The visualisation layer is OpenSearch Dashboards, the fork of Kibana that came with the project. Older documentation and third-party courses still say “built-in Kibana”; that name belongs to the Elastic product and does not describe what the service ships. If you are reading material that says Kibana, check its date.

What you get

Scale. A wide range of instance types including Graviton, up to 1,002 data nodes and up to 25 PB of attached storage. UltraWarm and cold storage tiers hold read-only data far more cheaply than hot nodes — the standard way to keep a long log retention affordable is to age indices down through them.

Security. IAM access control, VPC placement with security groups, encryption at rest and node-to-node encryption, index-level, document-level and field-level security, audit logs, and Dashboards multi-tenancy. Dashboards authenticates through Amazon Cognito, HTTP basic auth or SAML.

Stability. Multi-AZ deployment across two or three Availability Zones, dedicated master nodes to keep cluster management off the data nodes, and automated snapshots.

Interfaces. SQL support for business intelligence tools, and custom packages for tuning search results.

Deployment options

Beyond provisioned domains, the service also offers OpenSearch Serverless collections, billed in OpenSearch Compute Units rather than instance hours, and OpenSearch Ingestion pipelines for getting data in. Both appear on the bill under their own usage types (ServerlessOCU, IngestionOCU) rather than as ESInstance hours.

Version support has a cost attached

This is the part worth planning around. AWS supports both current OpenSearch versions and legacy Elasticsearch versions up to 7.10, but support is dated, and running past it is not free:

Versions under standard support get bug fixes and security updates.
Versions in extended support get critical security fixes for at least 12 months after standard support ends, and extended support charges apply automatically to a domain running one.
For the versions that have already been extended once — legacy Elasticsearch 1.5, 2.3, 5.1–5.5, 6.0–6.7 and 7.1–7.8, and OpenSearch 1.0–1.2 and 2.3–2.9 — the extended support surcharge from November 2026 is equal to the instance cost, effectively doubling the compute bill. Storage is unaffected.
For versions entering extended support from November 2027 — Elasticsearch 6.8, 7.9 and 7.10, OpenSearch 1.3, and OpenSearch 2.11 to 2.19 — the charge is a flat rate per Normalized Instance Hour on top of the instance cost.

Upgrade paths and breaking changes are version-specific, so treat a major upgrade as a project rather than a maintenance window. Check the current schedule before assuming a domain is safe — the dates have been revised.

When to use it over CloudWatch Logs

CloudWatch Logs Insights needs no cluster and is the lower-effort option. OpenSearch Service earns its operational overhead when you need genuine full-text search, sustained heavy querying over large volumes where per-query scanning charges accumulate, log data consolidated from multiple accounts or from outside AWS, or dashboards richer than CloudWatch provides. It is also the right answer when search is a product feature rather than an operational tool — powering site or application search, with the same cluster serving both.

Data reaches it from CloudWatch Logs, Kinesis Data Streams, Amazon Data Firehose, S3, DynamoDB and Lambda. It can in turn be a data source for Quick Sight, which is the usual route when log-derived metrics need to appear alongside business figures in the same dashboard.