Amazon OpenSearch Service
Managed search and analytics engine for log analytics, full-text search, and operational dashboards.
Verified against AWS documentation · 2026-09-09
Key facts
- 01A domain is a cluster — you pick instance types and node counts, AWS provisions, patches, and replaces failed nodes
- 02Two flavors: managed clusters (you size the nodes) and Serverless collections (capacity scales for you in OCUs)
- 03OpenSearch Dashboards is the built-in visualization UI — the successor to Kibana, included with every domain
- 04Storage tiers step down in cost and speed: hot (EBS) → UltraWarm → cold (both S3-backed)
- 05Reality check: this was Amazon Elasticsearch Service until 2021 — older question banks and blog posts still say "Elasticsearch"
Exam triggers
Phrases and scenarios that point here.
- "Full-text search", "relevance ranking", "search across large volumes of text" → OpenSearch
- "Centralized log analytics", "SIEM", "security analytics", "operational dashboards" → OpenSearch
- The word "Kibana" or "Elasticsearch" appears anywhere → the AWS answer is OpenSearch Service
- Streaming logs that must be searchable and visualized in near real time → Firehose or OpenSearch Ingestion into OpenSearch
Not this service
- Simple log storage with occasional queries and metric alarms → CloudWatch Logs
- Ad hoc SQL over files already sitting in S3 → Athena
- Business dashboards and charts for non-technical users → Amazon Quick (the service formerly called QuickSight)
Use cases
- 01Central log search across a whole fleet — app logs, VPC flow logs, and ALB logs in one index, so you trace a failed request without SSH-ing into a single box
- 02Product search on a storefront — typo tolerance, faceted filters (brand, size, price), and relevance tuning that a SQL LIKE query will never give you
- 03Security analytics — CloudTrail, WAF, and firewall logs indexed together so an analyst can follow one attacker's session across services
- 04Live operations dashboards — error rate, p99 latency, and order counts on a wall screen refreshing every few seconds
- 05Vector search for RAG chatbots — store embeddings next to your text and ask "find me things similar to this" instead of matching keywords
How it's charged
- 01Managed clusters: instance hours per node + EBS storage + data transfer — a running domain bills even with zero queries, and only deleting it stops the meter
- 02Serverless: OCU-hours metered separately for indexing and for search, plus managed storage per GB-month — NextGen collections scale to zero when idle, Classic collections bill a minimum OCU floor
- 03UltraWarm and cold storage hold data in S3 at a fraction of hot EBS cost — the standard lever for cutting a long log-retention bill
- 04Free: automated snapshots kept 14 days, node-to-node traffic inside a domain, and cross-AZ traffic within a Multi-AZ domain
- 05Commitment discounts: Reserved Instances (1 or 3 year) for managed clusters, or Database Savings Plans (1 year) that cover clusters and Serverless
