OpenSearch

OpenSearch is the community fork of Elasticsearch, maintained under the Apache 2.0 licence. It keeps the REST API, so AddisDB drives it with the same driver — bare index names, raw query bodies, or explicit method-and-path requests all work identically.

Who it is for

OpenSearch offers Elasticsearch’s capabilities under a permissive licence, with security, alerting and anomaly detection included rather than sold as a tier. AWS runs it as a managed service, which is where most teams meet it.

The fork happened at Elasticsearch 7.10, and the two have diverged since. Query bodies and the _cat APIs are still common ground; newer Elasticsearch-only features are not, and the version number a client sees does not line up between them.

Choose it when licensing matters, when you are on AWS and want a managed search cluster in your VPC, or when you want the observability features without a subscription.

Set up the cluster

1. Amazon OpenSearch Service: create a domain, choose public access or VPC, and set a fine-grained access-control master user.
2. Copy the domain endpoint from the console and note that it serves HTTPS on port 443.
3. For a VPC domain, you will need a bastion — configure the tunnel in the connection dialog.
4. Local: docker run -p 9200:9200 -e discovery.type=single-node -e DISABLE_SECURITY_PLUGIN=true opensearchproject/opensearch:latest.
5. Check the domain’s access policy as well as its network setting — a public domain with a restrictive policy still refuses you.

Connect from AddisDB

1. New Connection → OpenSearch under Search. Port prefills to 9200 and the username to admin.
2. Enter the host and password. For a managed AWS domain, set the port to 443 and SSL mode to require.
3. Index is optional — set a default index or leave it blank.
4. For a VPC-only domain, add your bastion under Tunnel (optional).
5. Test, then Save.

Fine-grained access control uses a master user with a password, which is what these fields expect. A domain configured for IAM-signed requests only is a different auth scheme and will reject basic credentials.

How to query it

// An index name — a capped match_all
logs-2026.07.31

// A raw query body against the default index
{ "query": { "range": { "@timestamp": { "gte": "now-1h" } } }, "size": 25 }

// Or an explicit request
GET /_cat/indices?format=json

The same .keyword rule applies as on Elasticsearch: aggregate on the keyword sub-field, not on the analyzed text field, or the request comes back as an error about fielddata.

What AddisDB gives you

• Indices and their mapped fields in the sidebar.
• Hits flattened into the grid with _id, _index and _score, plus the JSON tab for the raw response.
• Read-only enforcement — writes are blocked and only read endpoints pass through.
• SSH and AWS SSM tunnels for VPC-only domains.
• The Chart view for aggregations, and AI chat grounded in your indices.
• The same three query forms as Elasticsearch: index name, raw body, or explicit method and path.