{
 "slug": "opensearch",
 "name": "OpenSearch",
 "tagline": "Search, log analytics and observability suite with Dashboards",
 "category": "search",
 "use_cases": [
  "full-text-search",
  "log-analytics",
  "vector-search"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "OpenSearch Software Foundation",
  "url": "https://opensearch.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/opensearch-project/OpenSearch/blob/main/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   9200
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.9.0",
   "last_build": "2026-10-02",
   "entity_id": "prod-f4ekxq3lddse6",
   "ami_alias": "/aws/service/marketplace/prod-f4ekxq3lddse6/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-66rt74wx4t4vu",
   "recommended_instance_type": "m6i.xlarge",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.9.0",
   "last_build": "2026-10-02",
   "offer_id": "opensearch",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:opensearch:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.opensearch?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/opensearch/",
  "json": "https://lynxroute.com/products/opensearch/product.json"
 },
 "release_notes": [
  {
   "version": "3.9.0",
   "title": "OpenSearch 3.9.0",
   "notes": "* OpenSearch and OpenSearch Dashboards updated 3.8.0 -> 3.9.0. Apache-2.0 unchanged\n* Security: completion suggester bounded against heap exhaustion (CVE-2026-63136), Log4j updated to 2.25.5 (CVE-2026-49844), and Dashboards plugin dependencies updated to address multiple CVEs\n* Vector search: new half_float vector type roughly halves k-NN memory, plus 2-bit and 4-bit scalar quantization and opt-in dynamic mapping for knn_vector fields\n* Time-range queries now skip whole indexes outside the range before any shard work, and a new DELETE /_tasks/{task_id} API removes stored task results\n* Richer audit events (request correlation ID, user agent, roles and authentication method), and the Resource Sharing framework is now generally available\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "3.8.0",
   "title": "OpenSearch v-3.8.0",
   "notes": "* Re-release of OpenSearch 3.8.0. The application version is unchanged; this build refreshes the underlying operating system image\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-23"
   }
  },
  {
   "version": "3.8.0",
   "title": "OpenSearch v3.8.0",
   "notes": "* OpenSearch updated to 3.8.0 (minor update from 3.7.0). Apache-2.0 unchanged\n* New API to modify a data stream's backing indices (POST /_data_stream/_modify), a multivalue_doc_count aggregation returning the number of documents with two or more values, pull-based ingestion from Hive tables via the new ingestion-hive plugin, and client-side HTTP/3 support via the JDK HttpClient\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-23"
   }
  },
  {
   "version": "3.7.0",
   "title": "OpenSearch v3.7.0",
   "notes": "* Hardening re-release of OpenSearch 3.7.0 - upstream version unchanged\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-01"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.9.0",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "3.8.0",
   "aws": "2026-09-04",
   "azure": "2026-08-23"
  },
  {
   "version": "3.7.0",
   "aws": "2026-07-01"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-f4ekxq3lddse6/latest \\\n  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer opensearch --plan payg-gen2\naz vm create -g my-rg -n opensearch --size Standard_D4s_v3 \\\n  --image lynxroute:opensearch:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "OpenSearch is a community-driven, open source suite for search, log analytics and observability, forked from Elasticsearch and Kibana and now governed by the OpenSearch Software Foundation under the Linux Foundation. This image runs the suite single-node on one host: the OpenSearch engine (a Java/Lucene distributed search and analytics engine that indexes JSON documents and serves a REST API) and OpenSearch Dashboards (the Node visualization and management UI). It powers full-text and vector search, log and event analytics, dashboards, alerting and anomaly detection, with role-based access control and TLS enforced by the bundled security plugin. The engine and Dashboards are licensed Apache-2.0 - not Elastic SSPL - so the full stack is auditable with no vendor lock-in and no SaaS fees.",
  "image_adds": "Security hardening:\n* The security plugin's well-known demo TLS certificates are regenerated per-instance at first boot (a fresh private certificate authority, node and admin certificates) - the demo certificates never reach your instance\n* The default admin password is replaced with a strong password generated uniquely at first boot and written to /root/opensearch-credentials.txt (mode 0600)\n* The REST API on port 9200 is TLS-encrypted and authenticated (the security plugin) so it is safe to expose for ingestion; the inter-node transport port 9300 is bound to 127.0.0.1 only\n* Dashboards listens on 127.0.0.1:5601 and is reachable only through a TLS-terminating nginx on port 443, with a loading splash and readiness gate during startup\n* The JVM heap is sized to the instance, locked into memory, and vm.max_map_count is set so the engine starts reliably\n* UFW firewall pre-configured: only TCP 22, 443, and 9200 are open\n* fail2ban, auditd, and AppArmor pre-configured\n* CVE-scanned before every release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}