What is Amazon OpenSearch Service? Search, Analytics, and Vector Engine

Amazon OpenSearch Service is a managed AWS service for running OpenSearch, an open-source engine for full-text search, log analytics, and vector search. AWS sets up the clusters, patches the software, replicates the data, and takes backups. Your team loads data, writes queries, and builds dashboards or AI features on top.

This guide covers what is Amazon OpenSearch Service in plain terms: how it works, the difference between managed domains and serverless collections, how the vector engine supports generative AI, what it costs in 2026, and how to get started.

What Is Amazon OpenSearch Service?

Amazon OpenSearch Service began life as Amazon Elasticsearch Service. In 2021, after Elastic changed the license on Elasticsearch, AWS and the wider community created OpenSearch, an Apache 2.0 licensed project forked from Elasticsearch 7.10 and Kibana. The AWS service was renamed the same year.

OpenSearch now sits under the OpenSearch Software Foundation, part of the Linux Foundation, and many companies outside AWS contribute to it.

At its core, OpenSearch stores JSON documents and builds indexes that make them searchable in milliseconds. It handles three broad jobs. It powers search boxes on websites and apps. It collects and analyzes logs, metrics, and traces for operations and security teams. And it stores vector embeddings so AI applications can find content by meaning, beyond exact keyword matches.

The managed service removes most of the operational burden that comes with running a search cluster yourself. AWS still supports older Elasticsearch versions up to 7.10, which helps teams that are migrating existing workloads.

>>> Read more: The Data Journey: From Raw Data to Insights

How Amazon OpenSearch Service Works

A handful of concepts explain almost everything you will see in the console. Once they click, sizing and troubleshooting get much easier.

Domains and Nodes

A domain is an OpenSearch cluster that AWS manages for you. It contains data nodes that store and search your indexes, and dedicated master nodes that keep the cluster stable. You choose the instance types, the number of nodes, and how many Availability Zones to spread them across. Multi-AZ deployments with standby carry a 99.99% availability SLA.

Indexes, Shards, and Replicas

Data lives in indexes, which are collections of related documents such as product listings or one day of application logs. Each index splits into primary shards spread across nodes, and each primary shard can have replicas on other nodes. Shards let OpenSearch search in parallel, while replicas protect against node failures and add read capacity.

Storage Tiers

OpenSearch Service offers three tiers so you only pay hot-storage prices for data people actually query often:

• Hot storage runs on Amazon EBS or instance storage for the fastest reads and writes.
• UltraWarm keeps read-only data in Amazon S3 with caching, holding up to 3 PB per cluster at close to 90% lower cost per GB than hot storage.
• Cold storage detaches rarely used indexes entirely and reattaches them in seconds to minutes when someone needs them.
• Index State Management policies move data between these tiers automatically as it ages.

Querying Your Data

You can query OpenSearch through its REST API with the Query DSL, through SQL, or with Piped Processing Language (PPL), which suits log exploration. Results flow into OpenSearch Dashboards, the built-in visualization tool that grew out of Kibana.

>>> Read more: What is a Vector Database? How Vector Search Powers RAG and GenAI

Managed Clusters vs OpenSearch Serverless

AWS offers two ways to run OpenSearch. The right choice depends on how predictable your traffic is and how much control your team wants.

When Managed Domains Fit

Managed domains suit large, steady workloads where careful sizing pays off. Teams that need specific plugins, tight control over shard layout, or Reserved Instance discounts usually land here. Newer instance families such as OR1 store data durably in S3 and offer up to 30% better price-performance for indexing-heavy workloads.

When Serverless Fits

Serverless suits teams that would prefer to skip capacity planning entirely. It scales indexing and search compute separately as traffic changes. Classic serverless collections keep a small minimum of compute running, and AWS has introduced newer collection types that can scale to zero after a short idle period, which makes serverless far more attractive for development environments and low-traffic apps.

Core Capabilities of OpenSearch Service

The service has grown well beyond a search box. These are the capabilities that show up most often in real projects.

Full-Text Search

OpenSearch ranks results by relevance, handles typos with fuzzy matching, supports filters and facets, and offers autocomplete. Language analyzers cover dozens of languages, which matters for multilingual sites serving Vietnamese and English audiences.

Log and Observability Analytics

Operations teams ship application logs, infrastructure metrics, and traces into OpenSearch, then build dashboards and alerts on top. Built-in anomaly detection uses machine learning to flag unusual spikes before customers notice them.

Vector Engine for Generative AI

The vector engine stores embeddings and runs k-nearest neighbor (k-NN) search using algorithms such as HNSW and IVF. AWS states it can search billions of vectors in milliseconds, and GPU acceleration can build billion-scale indexes in under an hour. Hybrid search blends keyword and vector scores in one query, which usually beats either method on its own for product search and document retrieval.

Native Bedrock Integration

OpenSearch Serverless is a common vector store behind Amazon Bedrock Knowledge Bases. It handles retrieval for RAG applications, and Bedrock models can also generate embeddings during ingestion. A chatbot answering questions from internal policy documents is a typical example.

Security Analytics

Security teams can run threat detection directly inside OpenSearch. The feature ships with more than 2,200 prebuilt Sigma rules and works with logs from sources such as Amazon Security Lake, turning a log cluster into a lightweight SIEM.

Data Ingestion and Zero-ETL

Amazon OpenSearch Ingestion is a serverless pipeline that collects, filters, and enriches data before indexing it. Zero-ETL integrations sync data from Amazon DynamoDB and Amazon DocumentDB automatically, and direct query lets you search logs in S3 and Amazon CloudWatch without copying them first.

Amazon OpenSearch Service Pricing

Pricing depends on whether you run managed domains or serverless collections. The figures below are US East (N. Virginia) rates taken from the official OpenSearch Service pricing page.

A small production domain with three r8g.large.search data nodes and 100 GB of gp3 storage per node costs roughly $430 a month for instances plus about $37 for storage. A classic serverless collection with the minimum two OCUs running all month comes to around $350 for compute, while dev-test mode halves that to one OCU.

Watch these cost drivers as the cluster grows:

• Too many small shards waste memory and push teams into larger instances than they need.
• Keeping old logs in hot storage costs roughly ten times more per GB than UltraWarm.
• Replicas double storage and indexing work, so match the replica count to your availability needs.
• Serverless vector collections bill compute around the clock unless your collection type scales to zero.
• Reserved Instances cut managed domain costs significantly for steady, long-running clusters.

>>> Read more: AWS Cost Optimization: 10 Proven Strategies to Reduce Your Cloud Bill in 2026

OpenSearch Service Compared With Other Options

OpenSearch often lands on a shortlist with other search and vector tools. Each one fits a different situation.

Many architectures combine these. A common pattern keeps hot, frequently queried vectors in OpenSearch and archives the long tail in S3 Vectors, cutting storage costs while keeping search fast where it counts.

>>> Read more: What is Amazon Aurora? Architecture, Pricing, and When to Choose It Over RDS

Build Search and AI Solutions With Renova Cloud

Renova Cloud is an AWS Premier Tier Services Partner in Vietnam, holding the AWS DevOps, Migration, and AI Services Competencies. Our engineers design and run search, observability, and generative AI platforms for banks, retailers, manufacturers, and digital businesses across Southeast Asia.

We help teams choose between managed domains and serverless, size clusters to avoid wasted spend, build vector search and RAG pipelines with Amazon Bedrock, and migrate from self-managed Elasticsearch. We also set up lifecycle policies, security controls, and dashboards so your platform stays fast and affordable as data grows.

If you are planning AI-powered search or struggling with a costly logging cluster, our team is ready to help. Talk to Renova Cloud’s AWS experts today.