Skip to main content
In this lesson we cover Amazon OpenSearch: what it is, why you’d choose it over a traditional relational database, how it differs from Elasticsearch/Kibana, deployment options on AWS, key features, integrations, and common use cases.

​
Why use OpenSearch instead of a relational database?

Modern applications generate diverse data types — free-form text, logs and events, geospatial data, time-series metrics, and JSON or semi-structured documents. Relational databases excel at structured, schema-driven data but can struggle with:
  • fast full-text search,
  • flexible indexing of semi-structured documents,
  • high-throughput analytics across large text corpora,
  • and the operational patterns needed for observability and real-time search.
OpenSearch (a community-driven fork of Elasticsearch) is designed for indexing and querying these data types at scale. It provides real-time full-text search, aggregations, and analytics that make it ideal for search experiences, log management, observability, and analytics workloads.

​
When to choose OpenSearch vs a relational database

​
What is OpenSearch?

OpenSearch is a search and analytics engine originally forked from the last Apache License 2.0–compatible Elasticsearch and Kibana releases. It provides distributed indexing, searching, and analytics with a strong focus on observability, logging, and search experiences.

​
Elasticsearch vs OpenSearch (short comparison)

OpenSearch is a community-maintained fork of Elasticsearch/Kibana that preserves an open-source path for search and analytics use cases.

​
Core components and deployment options on AWS

On AWS you can deploy OpenSearch in two primary ways:
  • Amazon OpenSearch Service — managed OpenSearch clusters with options for instance types, storage, security, backups, and fine-grained access control.
  • OpenSearch Serverless — an on-demand, auto-scaling serverless option that removes much of the operational burden of provisioning and tuning clusters. AWS manages capacity and scaling.
OpenSearch Ingestion is a separate fully managed, serverless data collector that receives logs, metrics, and traces and delivers them to OpenSearch Service domains or OpenSearch Serverless collections. It can handle transformations, filtering, and enrichment before data is indexed, reducing the need to deploy third-party collectors like Logstash.
A diagram titled "AWS OpenSearch – Components" showing the ingestion flow: sources (Fluent Bit client, OTEL exporter, Amazon S3) feed into OpenSearch ingestion pipelines, which then store data into Amazon OpenSearch Service domains. Icons for Amazon OpenSearch Service and Amazon OpenSearch Serverless appear on the left.
OpenSearch Ingestion supports common producers such as Fluent Bit, OpenTelemetry exporters, and S3 event processors. It lets you apply parsing, enrichment, and routing rules so OpenSearch receives cleaned, indexed documents ready for search and analytics.
OpenSearch Ingestion simplifies getting data from producers into OpenSearch: apply transformations, filter noise, and route events without managing collector infrastructure.

​
Key features

  • Unified observability: Correlate logs, traces, and metrics to analyze service health and performance in context.
  • Full-text search and relevance: Powerful inverted-index search for low-latency query responses.
  • Aggregations and analytics: Grouping, histogramming, and statistical aggregations suited to operational analytics and dashboards.
  • Anomaly detection: Built-in ML-powered features to flag unusual patterns in metrics or logs.
  • Cross-cluster replication: Replicate indices and metadata between clusters for failover, geo-redundancy, or reporting offload.
  • Scale and capacity: Supports a wide range of instance types and architectures; can scale to petabyte-class storage with proper configuration.
  • SQL-style query support: Familiar SQL-like query syntax for users comfortable with relational queries; export results as JSON or CSV.
  • Trace analytics: Ingest and visualize OpenTelemetry data for distributed tracing and performance diagnosis.
A presentation slide titled "AWS OpenSearch – Features" showing six rounded tiles with icons and labels. The features listed are Application Analytics, Anomaly Detection, Cross‑Cluster Replication, 3 PB storage, SQL Query Syntax, and Trace Analytics.

​
Integrations with AWS services

OpenSearch integrates across the AWS ecosystem to simplify ingestion, security, monitoring, and visualization. Below is a concise mapping of common integrations and uses.
A slide titled "OpenSearch Integration" showing colored icons and labels for various AWS services (Amazon CloudWatch, AWS CloudTrail, Amazon Kinesis Video Streams, S3 Standard, IAM, AWS Lambda, Amazon DynamoDB, and Amazon QuickSight). Each service is represented by a square icon with a simple line drawing and a text label.

​
Common use cases

OpenSearch is widely adopted for:
  1. Observability — Centralize logs, metrics, and traces to monitor, alert, and debug distributed applications.
  2. Security information and event management (SIEM) — Real-time threat detection, searching, and incident response workflows.
  3. Search — Fast, relevant, and personalized search experiences for applications and websites.
A slide titled "Use Cases" with three numbered cards. They list 01 Monitor and Debug (orange laptop/bug icon), 02 SIEM (pink shield/code monitor icon), and 03 Personalized Search (green magnifying-glass icon).

​
Deployment guidance and best practices (brief)

  • For predictable workloads and full control over configuration, choose Amazon OpenSearch Service with dedicated instances and EBS or instance storage.
  • For variable or bursty workloads and lower operational overhead, OpenSearch Serverless can automatically scale and reduce management.
  • Use OpenSearch Ingestion or streaming services (Kinesis, Lambda) to centralize and transform telemetry before indexing.
  • Set up CloudWatch alarms on OpenSearch metrics (CPU, JVM memory pressure, disk utilization) and enable automated snapshots to S3.
  • Use IAM policies and fine-grained access control to restrict data access; enable TLS for encryption in transit.

​
Summary

OpenSearch is an open-source, community-driven search and analytics suite forked from Elasticsearch/Kibana. It supports high-performance full-text search, aggregations, trace analytics, and observability at scale. On AWS you can run OpenSearch as managed clusters (Amazon OpenSearch Service) or serverless collections (OpenSearch Serverless) and simplify ingestion with OpenSearch Ingestion. These options reduce operational complexity while enabling powerful search, monitoring, and analytics use cases.

Watch Video