AWS Elasticsearch (AWS ES) - OpenSRE Documentation

Overview

OpenSRE queries Amazon OpenSearch Service (formerly Amazon Elasticsearch Service, AWS ES) over its REST API to pull error logs and application events into its answers. This page covers AWS ES specifically; for self-hosted OpenSearch or Elastic Cloud, see the OpenSearch / Elasticsearch integration. AWS ES runs the same integration as self-hosted OpenSearch: there’s no separate “AWS ES” config, just an OPENSEARCH_URL pointed at your domain endpoint. Verify and setup use the opensearch service name.

Prerequisites

An Amazon OpenSearch Service (AWS ES) domain
The domain endpoint URL (e.g. https://search-mydomain-xxxxx.us-east-1.es.amazonaws.com)
Fine-grained access control enabled on the domain, with a dedicated internal user mapped to a read-only role (the built-in readall role works) rather than the master user

Setup

Option 1: CLI setup

opensre integrations setup opensearch

Pick OpenSearch / Elasticsearch.

Option 2: Environment variables

OPENSEARCH_URL=https://search-mydomain-xxxxx.us-east-1.es.amazonaws.com
OPENSEARCH_USERNAME=opensre-reader
OPENSEARCH_PASSWORD=opensre-reader-password

Variable	Default	Description
`OPENSEARCH_URL`	—	Required. Your AWS ES domain endpoint
`OPENSEARCH_USERNAME`	—	Internal user mapped to a read-only role, not the master user
`OPENSEARCH_PASSWORD`	—	Password for that internal user

Credentials

Create an internal user in fine-grained access control and map it to a read-only role (for example readall). Do not use the master user for OpenSRE.

Tools

Tool	What it returns
`query_elasticsearch_logs`	Log lines matching a query string within a time range, plus a filtered list of lines that look like errors (matches on `error`, `exception`, `timeout`, etc.)

The tool becomes available once the opensearch integration is configured. Availability is gated on sources["opensearch"].

Verify

opensre integrations verify opensearch

There is no separate elasticsearch verify target. For a local recipe (Docker container, seeded index, real tool output), see OpenSearch / Elasticsearch → Quick local test with Docker.

Troubleshooting

Symptom	Fix
403 Forbidden	Enable fine-grained access control; unsigned IAM resource-policy domains reject anonymous requests
API key auth fails	AWS ES / OpenSearch security plugin does not natively issue API keys — use Basic Auth
Wrong service name	Always use `opensearch` for setup/verify

Gotcha

This integration also supports an OPENSEARCH_API_KEY (used by Elastic Cloud), but AWS ES has no equivalent: the OpenSearch security plugin doesn’t natively issue API keys (opensearch-project/security#4009), so Basic Auth is the only option here. It does not sign requests with SigV4 either.

Security

Prefer a dedicated internal read-only user, not the master user.
Store credentials out of source control.

​Overview

​Prerequisites

​Setup

​Option 1: CLI setup

​Option 2: Environment variables

​Credentials

​Tools

​Verify

​Troubleshooting

​Gotcha

​Security