Overview

The successor of Amazon Elasticsearch Service (forked after the Elastic licensing change).
Lets you search any field, even partial matches — unlike DynamoDB queries which only work on primary keys/indexes.
Has its own query language (DSL); not SQL by default (a SQL plugin is available).
Common use: full-text search, log analytics, real-time application monitoring.

Deployment Modes

• Managed cluster — you provision the instances/nodes (more control over config).
• Serverless — on-demand, auto-scaling, no capacity management (OpenSearch Serverless).

Ingestion / Usage Patterns

Data is streamed in from another source, then OpenSearch is queried for search:

• DynamoDB Streams → Lambda → OpenSearch — DynamoDB is the source of truth; OpenSearch enables search on any attribute.
• Kinesis Data Streams / Kinesis Data Firehose → OpenSearch — near real-time log and event ingestion.
• CloudWatch Logs (subscription filter) → Lambda/Firehose → OpenSearch.
• Application data → OpenSearch for indexing and search.

OpenSearch Dashboards (Kibana)

• Visualization and dashboard tool bundled with OpenSearch (the open-source successor to Kibana).
• Used for real-time monitoring, log analytics, and alerting.

Security

• Access control via IAM, Cognito (for Dashboards), security groups, and fine-grained access control.
• Encryption at rest (KMS) and in transit (TLS).

Exam Tips

• "Search on any field / partial / full-text search" → OpenSearch (DynamoDB only queries keys/indexes).
• Classic pattern: DynamoDB + OpenSearch — DynamoDB for storage, OpenSearch for flexible search.
• "Near real-time log analytics & dashboards" → Kinesis Firehose → OpenSearch → Dashboards.
• Don't confuse with [[Athena]] (SQL on S3) — OpenSearch is for search and log analytics.