Lab: Install OpenSearch, index and search

What you will learn in this TP

• Start OpenSearch
• Declare types
• Search and aggregate

Introduction #

What you will learn in this section

• Start OpenSearch
• Declare types
• Search and aggregate

Context. Your team wants an Apache 2.0 log search engine. You evaluate OpenSearch on a prototype.

Prerequisites: Docker Compose, 4 GB of free memory  ·  Estimated time: 45 min

A node and its console.

Setup #

Guided steps, with their solution.

1. 1. Start the stack

   Why? Without a strong password, OpenSearch refuses to start.

   Write .env and the Compose file, set vm.max_map_count, then check cluster state.

2. 2. Declare an index template

   Why? A field type cannot change after the first write.

   Create a template for logs-app-*.

3. 3. Index in batches

   Why? _bulk is the normal path for data.

   Index three documents, then read the errors field of the response.

4. 4. Search and aggregate

   Why? filter is faster than must when the score does not matter.

   Search “banque” in the paiement service, then compute the p95 duration per service.

5. 5. Try PPL and the console

   Why? PPL is very readable for exploring logs.

   Count documents per level with PPL, then find them in Discover at http://localhost:5601.

Difficulty level : ●○○○○ (1/5)