> ## Documentation Index
> Fetch the complete documentation index at: https://opensre.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Elasticsearch (AWS ES)

> Connect Amazon OpenSearch Service (AWS ES) so OpenSRE can search application logs during investigations

OpenSRE queries Amazon OpenSearch Service (formerly Amazon Elasticsearch Service, AWS ES) over its REST API to pull error logs and application events into an investigation. This page covers AWS ES specifically; for self-hosted OpenSearch or Elastic Cloud, see the [OpenSearch / Elasticsearch integration](/docs/opensearch).

AWS ES runs the same integration as self-hosted OpenSearch: there's no separate "AWS ES" config, just an `OPENSEARCH_URL` pointed at your domain endpoint.

## Prerequisites

* An Amazon OpenSearch Service (AWS ES) domain
* The domain endpoint URL (e.g. `https://search-mydomain-xxxxx.us-east-1.es.amazonaws.com`)
* Fine-grained access control enabled on the domain, with a dedicated internal user mapped to a read-only role (the built-in `readall` role works) rather than the master user

## Setup

### Environment variables

```bash theme={null}
OPENSEARCH_URL=https://search-mydomain-xxxxx.us-east-1.es.amazonaws.com
OPENSEARCH_USERNAME=opensre-reader
OPENSEARCH_PASSWORD=opensre-reader-password
```

| Variable              | Default | Description                                                    |
| --------------------- | ------- | -------------------------------------------------------------- |
| `OPENSEARCH_URL`      | None    | Required. Your AWS ES domain endpoint.                         |
| `OPENSEARCH_USERNAME` | None    | Internal user mapped to a read-only role, not the master user. |
| `OPENSEARCH_PASSWORD` | None    | Password for that internal user.                               |

Or run `opensre onboard` and pick **OpenSearch / Elasticsearch**.

## Tools

| Tool                       | What it returns                                                                                                                                                |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `query_elasticsearch_logs` | Log lines matching a query string within a time range, plus a filtered list of lines that look like errors (matches on `error`, `exception`, `timeout`, etc.). |

The tool becomes available to the planner once the integration is configured and passes verification.

## Verify

```bash theme={null}
opensre integrations verify opensearch
```

## Gotcha

This integration also supports an `OPENSEARCH_API_KEY` (used by Elastic Cloud), but AWS ES has no equivalent: the OpenSearch security plugin doesn't natively issue API keys ([opensearch-project/security#4009](https://github.com/opensearch-project/security/issues/4009)), so Basic Auth is the only option here. It does **not** sign requests with SigV4 either. If your domain has no fine-grained access control and relies on an IAM-based resource policy instead, unsigned requests are treated as anonymous and rejected with 403 Forbidden. Enable fine-grained access control and use the internal user/password shown above.