Generated banner for Amazon Opensearch Service
Generated logo for Amazon Opensearch Service

Amazon Opensearch Service

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • Low risk

From the author

Guides migration, provisioning, search, log-analytics, trace-analytics, and Agentic AI Assistant workflows for Amazon OpenSearch Service and Serverless across six capabilities — migration (Solr/ES/self-managed into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, FGAC, monitoring); search (vector / semantic / hybrid / RAG with Bedrock); log-analytics (PPL, OSI, anomaly detection, Dashboards); trace-analytics (OTel spans, service maps, Data Prepper); ai-assistant (natural language data exploration, incident investigation, root cause analysis). Triggers on OpenSearch, AOS, AOSS, Elasticsearch, Solr, vector/k-NN/semantic/hybrid search, RAG, log analytics, PPL, trace analytics, ISM, FAISS, HNSW, Migration Assistant, UltraWarm, OR1, query my data, analyze logs, investigate errors, root cause analysis.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a unified framework for interacting with Amazon OpenSearch Service (AOS) and OpenSearch Serverless (AOSS). It covers the full lifecycle of OpenSearch operations, including migration from legacy systems like Solr or Elasticsearch, infrastructure provisioning, advanced search implementation (including vector and RAG), and observability through log and trace analytics. It also features an Agentic AI Assistant for natural language data exploration and incident investigation, ensuring users can navigate complex cluster management and data analysis tasks without manual query crafting.

What it does

  • Guides migration workflows from Solr, Elasticsearch, or self-managed OpenSearch to AOS/AOSS.
  • Assists with provisioning, lifecycle management, and monitoring of domains and collections.
  • Facilitates implementation of vector, semantic, and hybrid search, including RAG with Bedrock.
  • Supports log and trace analytics using PPL, OpenTelemetry, and anomaly detection.
  • Provides an Agentic AI Assistant for natural language querying and automated incident root cause analysis.
  • Enforces operational best practices for sharding, storage tiering, and security configurations.

When to use it

  • When planning a migration from legacy search engines to Amazon OpenSearch Service.
  • When setting up or optimizing search capabilities, including vector search and RAG.
  • When troubleshooting cluster health, performance, or shard allocation issues.
  • When performing log or trace analysis to investigate system incidents.
  • When you need to generate optimized PPL or DSL queries using natural language.

Advantages

  • Centralizes complex operational knowledge across six distinct OpenSearch capabilities.
  • Reduces manual query complexity by leveraging the Agentic AI Assistant.
  • Provides clear, actionable guidance on production failure modes and migration blockers.
  • Standardizes interactions through consistent CLI and data-plane patterns.
  • Promotes architectural best practices for scaling and cost-effective storage tiering.

Usage examples

“How do I migrate my existing Solr index to Amazon OpenSearch Service?”
The agent identifies the migration capability, explains that Solr to OpenSearch is a refactor migration, and guides you through using the Migration Assistant for data backfill.
“Why is my cluster status yellow and how can I fix it?”
The agent uses the AI Assistant capability to analyze cluster health, check shard allocation, and provide specific commands or steps to resolve unassigned shards.
“Help me set up a RAG pipeline using Bedrock and my OpenSearch domain.”
The agent routes to the search capability, providing instructions on configuring Bedrock connectors and vector index mappings for semantic retrieval.
“Find the root cause of the 503 errors in my application logs from the last hour.”
The agent utilizes the AI Assistant to query logs, perform time-series analysis, and correlate findings to identify the likely root cause of the errors.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/aws/amazon-opensearch-service/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip amazon-opensearch-service.zip -d .agents/skills

Documentation by AWS

Amazon OpenSearch Service — the unified skill

This skill answers anything about Amazon OpenSearch Service or Serverless across six capabilities. Step 0 below routes the question to ONE capability and points at that capability's entry-point reference. Everything else — when to dispatch, sub-references, capability-specific facts, cross-capability links — lives in the entry-point reference for that capability.

AWS MCP server is recommended, not required. Capability references show standard AWS CLI commands as the primary syntax (e.g., aws opensearch describe-domain, aws opensearchserverless create-collection). Where the AWS MCP server is available, its call_aws tool offers a streamlined alternative — but every operation in this skill MUST work via the AWS CLI alone. Data-plane HTTP calls against AOS / AOSS use awscurl for SigV4-signed requests; this works in both contexts.

Step 0: detect the capability — first thing you do

Pick one of the six capabilities below. State the detected capability in your first sentence (e.g., "Detected capability: SEARCH — semantic search setup with Bedrock embeddings."). Then load the entry-point reference; that file describes when to dispatch, indexes the rest of the capability's files, and routes you to the next step.

CapabilityEntry-point reference
migration — Solr / Elasticsearch / self-managed OpenSearch into AOS or AOSS. Schema/query translation, sizing, cutover.references/assessment-workflow.md
provisioning — Provisioning and managing AOS domains and AOSS collections. Lifecycle, upgrades, storage tiers, FGAC, monitoring.references/provisioning-reference.md
search — Vector / semantic / hybrid / sparse / dense / RAG retrieval. Bedrock connectors, FAISS HNSW vs Lucene.references/search-semantic-search-guide.md
log-analytics — Log search, observability, PPL, OSI ingestion, anomaly detection, OpenSearch Dashboards. Splunk/Datadog/ELK alternatives.references/log-analytics-guide.md
trace-analytics — Distributed traces with OpenTelemetry. Span queries, service maps, Data Prepper.references/trace-analytics-trace-queries.md
ai-assistant — Agentic AI Assistant: auto-discovers indices, generates optimized PPL/DSL queries, summarizes results, and investigates incidents end-to-end. No manual query crafting needed.references/ai-assistant.md

If a prompt spans capabilities (e.g., "migrate from Solr AND set up RAG on the new domain"), pick the dominant capability for the response and close with a one-line handoff to the other capability's entry-point ref.

Universal rules (apply to ALL capabilities)

These rules apply to every response, regardless of capability. Capability-specific rules (sizing math, shape detection, Migration Assistant for Amazon OpenSearch Service capability matrix, k-NN engine selection) live in the entry-point references, not here.

  • Report header (every multi-section response). Begin every multi-section response with a single fenced metadata block: > Generated: <ISO 8601 timestamp> | Skill: amazon-opensearch-service v<N>. Get the time by calling the current_time tool (returns ISO 8601 in UTC). Read the skill version from this file's frontmatter version: field. For one-line answers (terse FOCUSED_OPERATIONAL replies, anti-pattern refusals) the header is optional; for any multi-section deliverable it is REQUIRED. Place it immediately after the report title and before the first ## heading.

  • No dollar estimates (HARD CONSTRAINT). Never produce $X/month, ~$1,500, or any dollar figure. Route every cost question to https://calculator.aws and stop. If a sub-reference contains dollar figures, treat them as informational context only and do NOT pass them through to the user.

  • No credential leakage (HARD CONSTRAINT). Never include master usernames, KMS key ARNs, VPC endpoint URLs, instance IPs, or account IDs in generated output.

  • Pick one for every A-vs-B decision. Name a primary recommendation in one line with a one-sentence reason. A "go with B if..." caveat is allowed AFTER the primary; never lead with conditional-only guidance.

  • Source restatement. The first 2–3 sentences must restate the source (engine + version + scale) when known, or restate the customer's question in concrete terms. The very first text the user sees must NOT be tool narration, meta-commentary, the report title, or simply restating the question verbatim.

  • No marketing tone. Do NOT use "seamless", "robust", "best-in-class", "production-hardened", "enterprise-grade", "world-class", "cleanly", "elegant". Do NOT stack 3+ vague hedges ("typically", "generally", "usually", "in most cases") in a single recommendation — be specific about when it does and does not apply.

  • Cross-capability handoff. When a user prompt spans capabilities (e.g., "migrate from Solr AND set up RAG on the new domain"), pick the dominant capability for the response, then close with a one-line handoff: "For <other capability>, see references/<other-capability>-<entry>.md."

Cross-cutting references (used across multiple capabilities)

These references are not capability-prefixed because they apply across capabilities. Capability entry-point references load them when relevant; SKILL.md never loads them directly.

Assets (assets/): report templates for FULL_ASSESSMENT renderings (Solr-source, ES-source, executive summary).

What this skill does NOT do

  • Estimate dollar costs. Pricing changes monthly and account-specific (RI, Savings Plan, EDP) discount math is outside this skill's reliable scope. Use https://calculator.aws.

  • Move data. Use Migration Assistant for Amazon OpenSearch Service (Historical Data Migration for backfill, Live Traffic Migration for live cutover).

  • Build embedding models. Use Amazon Bedrock or SageMaker.

  • Replace Splunk SPL or Datadog APM 1:1. Some queries / detectors / dashboards need rewriting.

  • Tune relevance for a specific catalog. Use OpenSearch Benchmark big5 workload + your own judgment list.

Guardrail — where this skill's own files live (MCP vs local install)

This skill can be loaded two ways, and they resolve the skill's own bundled files from different places. Determine how the skill was loaded before reading a reference or running a script:

  • Loaded through the AWS MCP server's retrieve_skill tool: The skill is not installed on the local filesystem. You MUST fetch each reference or script via retrieve_skill with the file parameter (e.g. file="references/architecture.md" or file="scripts/deploy.py"), and run the script from the returned content. Do NOT file_read these paths locally — they do not exist on disk.

  • Installed locally (e.g. .kiro/skills/your-skill/ or ~/.claude/skills/your-skill/): Read and run files from the local skill directory using relative paths.

This distinction applies only to the skill's own packaged files. User data and session artifacts are always read from and written to the user's working directory. Never fetch or write customer data through retrieve_skill.

Files

references/vector-knn.md

Vector & k-NN search on Amazon OpenSearch

Canonical k-NN reference for this skill. The engine matrix and quantization comparisons below are the single source of truth — do NOT replicate elsewhere. Source of truth for current engine support: knn.html. Source of truth for Serverless vector workloads: serverless-vector-search.html.

The summary version (decision tree, dimensions, hybrid search 101) is in SKILL.md. This file owns the engine deep-dive, memory math, hybrid search recipes, RAG ingestion patterns, and ELSER alternatives.

Engine selection

EngineMax dimensionMethodsFilteringWhen
Lucene1,024HNSW onlySmart filtering (auto pre/post/exact) — best filter perf< 10M vectors, want metadata filters, latency-tolerant
FAISS16,000HNSW + IVF + PQ + scalarPre-filter with efficient_filter10M – billions; standard recall/latency trade-off
NMSLIB16,000HNSW onlyManualDEPRECATED in 2.19; REMOVED in OS 3.0+ — migrate to FAISS

On Serverless NextGen Vector, FAISS HNSW IS supported — the customer doesn't choose the engine, the system selects FAISS HNSW under the hood (Lucene HNSW, IVF, and PQ cannot be pinned on NextGen). Custom doc IDs supported. 32× compression default. 10s refresh interval.

On Serverless Classic Vector, FAISS HNSW IS supported (the only engine — explicit engine: faiss in mappings; Lucene k-NN, IVF, and PQ are NOT available on Classic). Custom _id rejected (use server-generated).

Deployment-target rule when the engine pick is Lucene k-NN: the response MUST recommend a Managed OpenSearch domain (provisioned). State explicitly: "AOSS NextGen and Classic Vector collections do not expose Lucene k-NN — only FAISS HNSW is available on Serverless. Lucene HNSW requires Managed." Without that line the customer may try to deploy a Lucene-engine workload on Serverless and discover the incompatibility at create time.

Phrasing rule when a customer is choosing Managed-vs-Serverless for a vector workload: do NOT say "FAISS-family" or "auto-picked FAISS-family" — that phrasing reads as fuzzy and the customer may infer Lucene parity. State plainly: "FAISS HNSW is supported on both Managed and Serverless VECTORSEARCH" (so engine parity is preserved across the move), then enumerate what is NOT available on Serverless (Lucene HNSW, IVF, PQ pinning, custom plugins, manual snapshots, custom _id on Classic, ISM, NMSLIB).

Dimensions reference

Embedding modelDimUse
all-MiniLM-L6-v2, all-MiniLM-L12-v2384Fast, small models
BERT-base, MPNet (all-mpnet-base-v2)768Common semantic search
Many newer models, Cohere1024Modern dense embeddings
OpenAI text-embedding-ada-0021536Common RAG default
OpenAI text-embedding-3-large, large modern3072High-quality (high cost)
Image embeddings (CLIP, DINOv2, etc.)512–1536Multimodal

Pick model FIRST; dimension follows.

Memory math (HNSW float — FAISS or Lucene)

This is the canonical formula for HNSW-graph memory on Amazon OpenSearch. Use it as written; do NOT substitute hand-wave approximations like "~512 bytes overhead per vector". The formula applies to both FAISS HNSW and Lucene HNSW (Lucene's per-vector graph overhead is ~10–15% lighter at the same m, but the same formula is the standard estimate and is what AWS docs use):

bytes_per_vector ≈ 1.1 × (4 × dim + 8 × m)
total_memory ≈ bytes_per_vector × num_vectors × (1 + replicas)

m=16 is typical (HNSW graph connectivity).

Required when sizing a vector workload: derive the memory number end-to-end on this formula in the response. Show inputs (dim, m, num_vectors, replicas), then the formula, then the numeric result. A bare "~23 GB for the graph" without the derivation is not reproducible from inputs — the rubric will flag it.

VectorsDimMemory (replicas=1)
1M384~3.5 GB
1M768~6.7 GB
1M1536~13.4 GB
10M768~67 GB
10M1536~134 GB
100M768~670 GB

AWS budget formula: memory_available = (RAM − jvm_size) × circuit_breaker_limit

  • jvm_size = min(0.5 × RAM, 32 GiB)

  • circuit_breaker_limit = 0.5 (default)

Example: r7g.4xlarge.search = 128 GiB RAM, JVM = 32 GiB, available for k-NN graphs ≈ (128 - 32) × 0.5 = 48 GiB.

Compression / quantization options

Architectural rule of thumb: int8 is the default; pick fp16 if your workload needs >99% recall on tail queries; binary only for >100M vectors (and always with a rerank pass). mode: "on_disk" keeps recall at 100% but trades latency for RAM.

Memory ratios (stable): fp32→fp16 = 2×, fp32→int8 = 4×, fp32→int4 = 8×, fp32→binary = 32×.

For current per-method recall benchmarks (which AWS republishes per release), see knn-vector-quantization.html.

Hybrid search (text + vector)

OpenSearch's hybrid query (GA in 2.10) combines BM25 with k-NN/neural at the coordinator via search pipelines.

Why normalization is required
  • BM25 score: unbounded ≥ 0

  • k-NN/neural score: 0.0–1.0

  • Direct sum biases toward BM25.

Two combination strategies

1. Score normalization (normalization-processor) — GA in 2.10:

PUT _search/pipeline/hybrid-norm
{
  "phase_results_processors": [
    {
      "normalization-processor": {
        "normalization": { "technique": "min_max" },
        "combination": {
          "technique": "arithmetic_mean",
          "parameters": { "weights": [0.3, 0.7] }
        }
      }
    }
  ]
}

Best benchmarked combo: min_max + arithmetic_mean weighted 30% BM25 / 70% vector.

2. Reciprocal Rank Fusion (score-ranker-processor) — added in 2.19:

PUT _search/pipeline/hybrid-rrf
{
  "phase_results_processors": [
    {
      "score-ranker-processor": {
        "combination": {
          "technique": "rrf",
          "rank_constant": 60
        }
      }
    }
  ]
}

Formula: rankScore(d) = Σ 1/(k + rank_i) where k = rank_constant (default 60).

Trade-off (per OpenSearch's own benchmark):

  • RRF: −3.86% NDCG@10 vs normalization, +1.62% p50 latency

  • RRF more stable across varying score distributions and outliers

Hybrid query DSL
GET my-index/_search?search_pipeline=hybrid-norm
{
  "query": {
    "hybrid": {
      "queries": [
        { "match": { "body": "wireless headphones" } },
        {
          "neural": {
            "embedding_field": {
              "query_text": "wireless headphones",
              "model_id": "<bedrock-model-id>",
              "k": 100
            }
          }
        }
      ]
    }
  },
  "size": 100
}

Optimal k and size: 100–200.

Typical relevance lift (OpenSearch benchmark)
  • Hybrid vs keyword-only: 8–12% NDCG@10 improvement

  • Hybrid vs neural-only: 15% NDCG@10 improvement

  • Latency cost: 6–8% over Boolean

RAG ingestion pattern

Standard flow:

1. CHUNK    → split docs into 256–512 token segments (semantic boundaries help)
2. EMBED    → call Bedrock (Titan, Cohere) or SageMaker model
3. INDEX    → write knn_vector field + original text + metadata
4. QUERY    → hybrid query (BM25 + vector neural)
5. RERANK   → optional cross-encoder rerank for top-K
6. RETURN   → top-K chunks to LLM context
Index mapping
PUT rag-corpus
{
  "settings": {
    "index.knn": true,
    "index.knn.algo_param.ef_search": 100,
    "default_pipeline": "embed-on-write"
  },
  "mappings": {
    "properties": {
      "text":         { "type": "text" },
      "embedding":    {
        "type": "knn_vector",
        "dimension": 1024,
        "method": {
          "engine": "faiss",
          "name": "hnsw",
          "space_type": "innerproduct",
          "parameters": { "m": 16, "ef_construction": 256 }
        }
      },
      "doc_id":       { "type": "keyword" },
      "source_url":   { "type": "keyword" },
      "chunk_index":  { "type": "integer" },
      "ingested_at":  { "type": "date" }
    }
  }
}
Embed-on-write via OSI

OpenSearch Ingestion has a Bedrock processor that embeds on write:

embed-on-write:
  source:
    s3:
      ...
  processor:
    - bedrock:
        model: amazon.titan-embed-text-v2:0
        input_field: text
        output_field: embedding
  sink:
    - opensearch:
        ...
Filtered RAG

Combine vector + metadata filter via efficient_filter:

{
  "neural": {
    "embedding": {
      "query_text": "...",
      "model_id": "...",
      "k": 100,
      "filter": {
        "bool": {
          "must": [
            { "term":  { "tenant_id": "abc" } },
            { "range": { "ingested_at": { "gte": "now-30d" } } }
          ]
        }
      }
    }
  }
}

Pre-filter (Lucene smart filtering): runs the metadata filter first, then k-NN over the candidate set. Best performance for selective filters.

Post-filter: returns < k results when filter rejects vectors. Use only when filter is very permissive.

Lucene exact-search fallback under highly selective filters

When recommending Lucene HNSW for a workload with a highly selective metadata filter (e.g. ACL pre-filter that narrows to a tiny fraction of the corpus, like 3–8 spaces out of hundreds), the response MUST flag the exact-search fallback:

"On highly selective filters, Lucene's smart filtering automatically falls back to exact (brute-force) search over the post-filter candidate set instead of approximate HNSW traversal. This preserves recall (no graph-traversal recall cliff) but latency rises with candidate count — budget for it. FAISS HNSW with efficient_filter does NOT have this fallback and will produce recall degradation on the same selective-filter workload, which is why Lucene wins this case."

This is the load-bearing reason Lucene HNSW beats FAISS HNSW on selective-filter workloads. Without surfacing the fallback the recommendation reads as a vendor preference rather than a rooted choice.

ELSER alternatives on Amazon OpenSearch

This is the canonical ELSER-alternatives section for the skill. Other files (assessment-gotchas, assessment-workflow ES feature table) link here.

ELSER (Elastic Learned Sparse Encoder) is proprietary to Elastic — not available on Amazon OpenSearch.

OpenSearch alternatives:

  1. Neural sparse search (neural_sparse query) — uses a SageMaker-hosted sparse-encoder model (e.g., SPLADE).

  2. Dense vectors via Bedrock:

    • Amazon Titan Embed Text v2 (1024 dim)

    • Cohere Embed English/Multilingual (1024 dim)

  3. Hybrid: BM25 + dense vector — often gets you most of ELSER's benefit without the proprietary tax.

  4. Custom sparse model via ml-commons connector to your own SageMaker endpoint.

{
  "query": {
    "neural_sparse": {
      "embedding_field": {
        "query_text": "search query",
        "model_id": "<sparse-model-id>"
      }
    }
  }
}

OpenSearch 3.0 vector improvements

Canonical list for this skill — sizing.md and other refs link here rather than duplicating these bullets.

  • GPU-accelerated index build: up to 9.3× faster, 3.75× cost reduction

  • Derived-source vectors: 3× storage reduction, 30× cold-start improvement

  • Concurrent segment search default-on for k-NN: 2.5× boost

  • Star-tree indexing: aggregations up to 100× faster

  • Native MCP (Model Context Protocol) support for AI agents

Production-scale data points

  • Amazon Music: 1.05B vectors, 7,100 QPS on a single OpenSearch cluster (FAISS HNSW)

  • This validates the platform at high scale

Critical gotchas for vector workloads

  1. Vector Search collections cannot share OCUs with Search/TimeSeries on Serverless. Adding one vector collection roughly doubles idle floor.

  2. Cannot change dimension or engine of existing index — must reindex.

  3. post_filter returns < k results if filter rejects vectors near the query. Use efficient_filter instead for filtered k-NN.

  4. NMSLIB → FAISS migration requires reindex. NMSLIB is removed in OS 3.0+.

  5. Lucene engine max dimension is 1,024 — pick FAISS for higher-dim embeddings.

  6. k-NN UltraWarm/Cold migration requires OS 2.17+. k-NN indexes don't force-merge to single segment during UltraWarm migration.

  7. uw.medium cannot host k-NN — RAM headroom insufficient. Use uw.large and size graphs ≤ circuit_breaker_limit × 61 GiB per instance.

  8. Memory pressure on k-NN nodes isn't always reflected in JVM pressure (graphs are off-heap). Watch native memory metrics.

Validate before production

Use OpenSearch Benchmark with the noaa_semantic_search workload, or build your own with a representative query set. Measure NDCG@10, p50/p95/p99 latency, and memory utilization at expected QPS.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/amazon-opensearch-service · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
aws/agent-toolkit-for-aws

AutoGineer is not affiliated with or endorsed by AWS or AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download amazon-opensearch-service.zip