RousselTMLEARNING

TP · OpenSearch: from discovery to expertise

Lab: Install OpenSearch, index and search

What you will learn in this TP
Start OpenSearch
Declare types
Search and aggregate

Introduction #

What you will learn in this section
Start OpenSearch
Declare types
Search and aggregate

Context. Your team wants an Apache 2.0 log search engine. You evaluate OpenSearch on a prototype.

Prerequisites: Docker Compose, 4 GB of free memory · Estimated time: 45 min

A node and its console.

Setup #

Guided steps, with their solution.

1. Start the stack
Why? Without a strong password, OpenSearch refuses to start.
Write .env and the Compose file, set vm.max_map_count, then check cluster state.
2. Declare an index template
Why? A field type cannot change after the first write.
Create a template for logs-app-*.
3. Index in batches
Why? _bulk is the normal path for data.
Index three documents, then read the errors field of the response.
4. Search and aggregate
Why? filter is faster than must when the score does not matter.
Search “banque” in the paiement service, then compute the p95 duration per service.
5. Try PPL and the console
Why? PPL is very readable for exploring logs.
Count documents per level with PPL, then find them in Discover at http://localhost:5601.

Difficulty level : ●○○○○ (1/5)

My progress

⏱ Estimated time : ≈ 45 min

Sign in to track your progress and take notes. Sign in

💬 Ask a question

← Previous session See the correction ⬇ Download the lab (PDF) Next session →

Recommended Articles

Installing OpenSearch and OpenSearch Dashboards

Install OpenSearch with Docker Compose or the archive: initial password, vm.max_map_count, demo c...

Indexing and searching in OpenSearch: mapping, DSL, PPL and SQL

Declare an index template, index with bulk, search with the Query DSL, aggregate and query with P...

OpenSearch Dashboards, alerting and observability

Explore data in OpenSearch Dashboards, create alert monitors and discover Trace Analytics, Event ...

OpenSearch: concepts, architecture and differences with Elasticsearch

Understanding OpenSearch: project origin, license, differences with Elasticsearch, indexes, shard...

Feeding OpenSearch: ingest pipelines and Data Prepper

Transform data with ingest pipelines, collect with Data Prepper, receive OTLP and avoid the dynam...

OpenSearch in production: ISM, backups, security and best practices

Automate the lifecycle with ISM, back up with snapshots, manage roles and size an OpenSearch clus...

Data streams et templates Elasticsearch : component templates, index templates et séries temporelles

Gérer les données horodatées avec les data streams : index templates et component templates, conv...

Query DSL et agrégations avancées Elasticsearch, avec ES|QL

Écrire des requêtes Elasticsearch avancées : bool, filter et score, nested, function_score et per...

Cross-cluster search et cross-cluster replication : architectures multi-clusters Elasticsearch

Concevoir des architectures multi-clusters Elasticsearch : clusters distants, cross-cluster searc...