For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/pt/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/pt/llms-full.txt, and this page is available as Markdown at https://docs.ovhcloud.com/pt/guides/public-cloud/databases/opensearch-getting-started.md.

OpenSearch - Getting started

Ver como Markdown

Find out how to set up and manage your Public Cloud Databases for OpenSearch

Objectives

OpenSearch is an open-source search and analytics suite used for a variety of use cases related to log and data analysis, real-time monitoring, and application searching. Forked from Elasticsearch and Kibana, OpenSearch offers users a highly-scalable system with easy access to large amounts of data and integrated metrics.

This guide explains how to successfully configure a Public Cloud Databases for an OpenSearch service in the OVHcloud Control Panel.

Requirements

OVHcloud Control Panel Access

  • Direct link:
  • Navigation path: Public Cloud > Select your project > Analytics

Instructions

Subscribe to the service

Click on the Create a service button.

The creation form is displayed on a single page, organised in the following sections:

  • Service: select OpenSearch and the version to install. A name is generated automatically for your service; you can change it later.
  • Datacentre: choose the geographical region of the datacentre in which your service will be hosted.
  • Service plan: choose an appropriate service plan. If needed, you will be able to upgrade the plan after creation.
  • Instance: choose the node template. The number of nodes depends on the service plan.
  • Storage: check the storage included with the node template. If needed, you can add additional storage, billed separately.
  • Options: decide to attach a public or private network and, optionally, add the authorised IPs.

Please visit the OpenSearch capabilities page for the available versions and for detailed information on each plan's properties and hardware resources.

Take note of the pricing information in the order summary. The API and Terraform equivalent button displays the equivalent of creating this service with the OVHcloud API or Terraform. Click on Order to create your service.

In a matter of minutes, your new database service will be deployed. Messages in the OVHcloud Control Panel will inform you when the database is ready to use.

Configure the OpenSearch service

Once the Public Cloud Databases for OpenSearch service is up and running, you will have to define at least one user and one authorised IP to fully connect to the service.

The Dashboard tab gives an overview of your service, including the Connection information you need to connect to it.

Step 1 (mandatory): set up a user

Switch to the Users tab. A default user, avnadmin, is pre-configured during the service installation, without any ACL rule: if you enable ACLs, give it the pattern * with the admin permission, otherwise it no longer has access to the service. To add more users, click Add user.

Enter a username (3 to 32 characters) and, if needed, its ACLs (see below), then click Create User.

Once the user is created, the password is generated. Please keep it securely as it will not be shown again.

You can then reset the password of any user, including avnadmin, via the ... button in the Users tab, then Reset password.

Step 2 (mandatory): configure authorised IPs

Warning

For security reasons the default network configuration doesn't allow any incoming connections. It is thus critical you authorize the suitable IP addresses in order to successfully access your database.

If you did not add any IP when creating the service, switch to the Configuration tab. At least one IP address must be authorised in the IPs section before you can connect to your database. It can be your laptop IP for example.

Enter a single IP address or an IP block in the IP address or IP/mask field and add it to the list. You can also remove IP addresses from the list. Click on Save changes to apply your changes.

If you don't know how to get your IP, please visit a website such as www.WhatismyIP.com. Copy the IP address shown on this website and save them for later.

Your OpenSearch service is now fully accessible!

Optionally, you can configure access control lists (ACL) for granular permissions.

Optional: configure ACLs

OpenSearch database supports index-level access control lists (ACLs) to control permissions. This approach allows you to limit the operations that are available to specific connections and to restrict access to certain data sets, which improves the security of your data.

ACLs are managed in the Users tab. Make sure the Enable ACLs option is switched on, then define the ACLs of each user when you add or edit it.

You can grant the following permissions:

  • deny: no access
  • admin: full access to APIs and documents
  • readwrite: full access to documents
  • read: allows only searching and retrieving documents
  • write: allows updating, adding, and deleting documents

Note: Write permission allows the service user to create new indexes that match the pattern, but it does not allow deletion of those indexes.

Rules are defined separately for each user as pattern / permission combinations. The pattern defines the indexes that the permission applies to. Patterns are glob-style, where * matches any number of characters and ? matches any character.

When multiple rules match, they are applied in the order listed above. If ACLs are enabled and no rules match, access is denied.

Control access to top-level APIs

OpenSearch has several "top-level" API endpoints (_mget, _msearch, and so on). When ACLs are enabled, requests to these endpoints are checked against the user's index rules: a user can, for example, run _msearch or _mget on the indexes it is allowed to access, without any dedicated rule. To grant broader access to top-level APIs, use patterns similar to the index patterns, for example:

  • pattern _* with the admin permission grants unlimited access to all top-level APIs
  • pattern _msearch with the admin permission grants unlimited access to the _msearch API only
Access control and OpenSearch Dashboards

Enabling ACLs does not restrict access to OpenSearch Dashboards itself, but all requests done by OpenSearch Dashboards are checked against the current user's ACLs: a user only sees and queries the indexes its rules allow.

Advanced configuration

Indexes and index patterns

An index contains a database schema. Each data is based on a basic unit which is a JSON document, indexed with a unique ID. Indexing is the method used to store data and by the search engine for fast retrieval.

You can learn more by browsing the OpenSearch official documentation - Managing indexes.

Indexes cannot be created from the OVHcloud Control Panel: create them through the OpenSearch API (see the cURL example below), or let OpenSearch create them automatically when you write the first document.

The Index patterns tab lets you limit the number of indexes kept for a given pattern, which is useful, for example, when an index is created every day to store logs. Click on Add a pattern, enter a pattern (* matches any number of characters and ? matches any character) and a Maximum number of indexes, then confirm. When more indexes than this maximum match the pattern, the oldest ones are deleted. A value of 0 means that the pattern is not evaluated (no limit).

The same tab lists the indexes of your service. You can delete an index from this list.

Automatic backups

OVHcloud performs hourly and daily backups for your Public Cloud Databases for the OpenSearch service. To find them, switch to the Backups tab. Backups will be created automatically, and retention time depends on the service plan. Please visit the Public Cloud Databases for OpenSearch capabilities page for detailed information on each plan's properties.

Via the ... button, you can restore a backup by duplicating it to a new service with Duplicate (Fork). Backups cannot be deleted. For more information, read our guides on backups and on restoring a backup.

Connection to the OpenSearch Dashboard

Warning

Verify that the IP address visible from your browser application is part of the authorised IPs defined for this OpenSearch Database service.

In the Dashboard tab of the Public Cloud Databases for OpenSearch service, the Connection information section shows the OpenSearch Dashboards endpoint, on the same host as the OpenSearch service: https://<service-host>:443. Open it in a web browser and log in with a user that has the required ACLs (see above). You will go to this page:

First connection to Kibana

Load sample data

Warning

If you have enabled ACLs in a previous step and don't want to disable them, then make sure your user has the readwrite permission on the opensearch_dashboards_sample_data_* pattern. Rules on _bulk or _mget are not needed.

Without this permission you will not be able to add the sample data and view the corresponding dashboard.

As proposed natively in OpenSearch, we can load sample data to the OpenSearch database:

Data sample import

For the following example, we will use the Sample web logs.

Once imported, you can get access to the main OpenSearch dashboard created for this sample. Click on the View Data button:

Kibana Web Logs Sample

Dashboard and queries can be edited directly through this web interface.

Load your data

To load your own data, see the official documentation, which describes several methods: https://docs.opensearch.org/latest/tools/.

Query the OpenSearch service

DB queries with cURL

Once the service is up and configured, you can try to connect from a remote session to it. You need to have at least:

  • the user login and password, with accurate ACLs if enabled;
  • the host and port of the OpenSearch service. They can be found in the Connection information section of the Dashboard tab. The port is specific to each service.
Warning

Verify that the IP address of your system running the cURL command is part of the authorised IPs defined for this OpenSearch Database service.

The URI displayed in the Control Panel starts with opensearch://. To use it with cURL, replace this scheme with https://. Once ready, try this in a command line, with your personal user and password:

export OPENSEARCH_URL=https://<service-host>:<port>
export OPENSEARCH_AUTH=<username>:<password>

Then try to connect:

curl -u $OPENSEARCH_AUTH $OPENSEARCH_URL

The database response should be similar to:

{
  "name" : "opensearch-<service-id>-1",
  "cluster_name" : "<cluster-name>",
  "cluster_uuid" : "<cluster-uuid>",
  "version" : {
    "distribution" : "opensearch",
    "number" : "3.3.2",
    "build_type" : "unknown",
    "build_hash" : "unknown",
    "build_date" : "2026-08-19T00:00Z",
    "build_snapshot" : false,
    "lucene_version" : "10.3.1",
    "minimum_wire_compatibility_version" : "2.19.0",
    "minimum_index_compatibility_version" : "2.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

Now create an index:

curl -u $OPENSEARCH_AUTH -X PUT $OPENSEARCH_URL/my-index

In case of a wrongly defined ACL for the user, the response will be similar to:

{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [indices:admin/create] and User [name=<username>, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [indices:admin/create] and User [name=<username>, backend_roles=[], requestedTenant=null]"},"status":403}

Try to add a document:

curl -u $OPENSEARCH_AUTH -X PUT $OPENSEARCH_URL/my-index/_doc/1 -H 'Content-Type: application/json' -d '{"Description": "To be or not to be, that is the question."}'

Retrieve the data:

curl -u $OPENSEARCH_AUTH -X GET $OPENSEARCH_URL/my-index/_doc/1

Delete the data:

curl -u $OPENSEARCH_AUTH -X DELETE $OPENSEARCH_URL/my-index/_doc/1

Delete the index:

curl -u $OPENSEARCH_AUTH -X DELETE $OPENSEARCH_URL/my-index/
Info

With the readwrite permission, a user can create an index matching its pattern and add, read or delete documents, but cannot delete the index itself: deleting an index requires the admin permission on a matching pattern. You can also delete an index from the Index patterns tab.

DB queries with the Dashboard Dev Tool

For direct queries with a web interface to the OpenSearch database you can use the Dev Tools available in the menu:

Kibana Dev Tools

The Console is split in two, a left column for the command to execute, and the right one for the results.

Kibana Console

Click on the triangle to execute the highlighted request.

We can execute the same commands as we did with cURL:

Kibana cURL commands

Go further

You service is now configured. To go further,

OpenSearch capabilities

Getting started with Analytics using the API, CLI or Terraform

OpenSearch Official documentation

Visit the Github examples repository to find how to connect to your database with several languages.

Visit our dedicated Discord channel: https://discord.gg/ovhcloud. Ask questions, provide feedback and interact directly with the team that builds our databases services.

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analysed by our experts.

Esta página foi útil?