Skip to main content
OpenSRE queries Amazon OpenSearch Service (formerly Amazon Elasticsearch Service, AWS ES) over its REST API to pull error logs and application events into an investigation. This page covers AWS ES specifically; for self-hosted OpenSearch or Elastic Cloud, see the OpenSearch / Elasticsearch integration. AWS ES runs the same integration as self-hosted OpenSearch: there’s no separate “AWS ES” config, just an OPENSEARCH_URL pointed at your domain endpoint.

​
Prerequisites

  • An Amazon OpenSearch Service (AWS ES) domain
  • The domain endpoint URL (e.g. https://search-mydomain-xxxxx.us-east-1.es.amazonaws.com)
  • Fine-grained access control enabled on the domain, with a dedicated internal user mapped to a read-only role (the built-in readall role works) rather than the master user

​
Setup

​
Environment variables

Or run opensre onboard and pick OpenSearch / Elasticsearch.

​
Tools

The tool becomes available to the planner once the integration is configured and passes verification.

​
Verify

​
Gotcha

This integration also supports an OPENSEARCH_API_KEY (used by Elastic Cloud), but AWS ES has no equivalent: the OpenSearch security plugin doesn’t natively issue API keys (opensearch-project/security#4009), so Basic Auth is the only option here. It does not sign requests with SigV4 either. If your domain has no fine-grained access control and relies on an IAM-based resource policy instead, unsigned requests are treated as anonymous and rejected with 403 Forbidden. Enable fine-grained access control and use the internal user/password shown above.