1
# ======================== OpenSearch Production Configuration =========================
2

3
# ---------------------------------- Cluster -----------------------------------
4
cluster.name: production-opensearch
5

6
# Prevent split brain
7
cluster.initial_master_nodes:
8
  - master-node-1
9
  - master-node-2
10
  - master-node-3
11

12
# Cluster routing settings
13
cluster.routing.allocation.disk.threshold_enabled: true
14
cluster.routing.allocation.disk.watermark.low: 85%
15
cluster.routing.allocation.disk.watermark.high: 90%
16
cluster.routing.allocation.disk.watermark.flood_stage: 95%
17

18
# ------------------------------------ Node ------------------------------------
19
node.name: ${NODE_NAME}
20
node.roles: [data, ingest, master, ml, remote_cluster_client]
21

22
# Node attributes for shard allocation awareness
23
node.attr.zone: ${ZONE}
24
node.attr.temp: hot
25

26
# ----------------------------------- Paths ------------------------------------
27
path.data: /var/lib/opensearch
28
path.logs: /var/log/opensearch
29
path.repo: /backup/opensearch
30

31
# ----------------------------------- Memory -----------------------------------
32
# Lock memory to prevent swapping
33
bootstrap.memory_lock: true
34

35
# ---------------------------------- Network -----------------------------------
36
network.host: ${NETWORK_HOST}
37
http.port: 9200
38
transport.port: 9300
39

40
# Bind to both loopback and external
41
network.bind_host: 0.0.0.0
42
network.publish_host: ${EXTERNAL_IP}
43

44
# --------------------------------- Discovery ----------------------------------
45
discovery.seed_hosts:
46
  - master-node-1:9300
47
  - master-node-2:9300
48
  - master-node-3:9300
49

50
# Minimum master nodes to prevent split brain
51
discovery.zen.minimum_master_nodes: 2
52

53
# ---------------------------------- Security ----------------------------------
54
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/certs/node.pem
55
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/certs/node-key.pem
56
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/certs/root-ca.pem
57
plugins.security.ssl.transport.enforce_hostname_verification: true
58
plugins.security.ssl.transport.resolve_hostname: true
59

60
plugins.security.ssl.http.enabled: true
61
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/certs/node.pem
62
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/certs/node-key.pem
63
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/certs/root-ca.pem
64

65
# Security plugin settings
66
plugins.security.authcz.admin_dn:
67
  - CN=admin,OU=IT,O=Company,L=City,C=US
68

69
plugins.security.nodes_dn:
70
  - CN=*.opensearch.company.com,OU=IT,O=Company,L=City,C=US
71

72
plugins.security.audit.enable_rest: true
73
plugins.security.audit.enable_transport: false
74
plugins.security.audit.resolve_bulk_requests: true
75
plugins.security.audit.config.disabled_rest_categories: NONE
76
plugins.security.audit.config.disabled_transport_categories: NONE
77

78
# ---------------------------------- Performance -------------------------------
79
# Thread pool settings
80
thread_pool.search.size: 50
81
thread_pool.search.queue_size: 1000
82
thread_pool.write.size: 30
83
thread_pool.write.queue_size: 500
84

85
# Indexing buffer
86
indices.memory.index_buffer_size: 20%
87
indices.memory.min_index_buffer_size: 96mb
88

89
# Field data cache
90
indices.fielddata.cache.size: 30%
91

92
# Query cache
93
indices.queries.cache.size: 10%
94

95
# Request cache
96
indices.requests.cache.size: 2%
97

98
# Recovery settings
99
indices.recovery.max_bytes_per_sec: 100mb
100

101
# ---------------------------------- Monitoring --------------------------------
102
# Enable monitoring
103
http.cors.enabled: true
104
http.cors.allow-origin: "*"
105
http.cors.allow-headers: "X-Requested-With,X-Auth-Token,Content-Type,Content-Length,Authorization"
106
http.cors.allow-credentials: true
107

108
# ---------------------------------- Snapshot ----------------------------------
109
# Repository settings
110
repositories.url.allowed_urls:
111
  - "http://backup.company.com/*"
112
  - "https://s3.amazonaws.com/*"
113

114
# ----------------------------------- Misc -------------------------------------
115
# Prevent accidental cluster deletion
116
action.destructive_requires_name: true
117

118
# Script settings
119
script.allowed_types: inline, stored
120
script.allowed_contexts: search, update, ingest
121

122
# Machine learning
123
node.ml: true
124
xpack.ml.enabled: true

1
#!/bin/bash
2
# Generate certificates for OpenSearch cluster
3

4
# Create CA
5
openssl genrsa -out root-ca-key.pem 2048
6
openssl req -new -x509 -sha256 -key root-ca-key.pem -out root-ca.pem -days 3650 \
7
  -subj "/C=US/ST=State/L=City/O=Company/OU=IT/CN=OpenSearch Root CA"
8

9
# Create node certificate
10
openssl genrsa -out node-key-temp.pem 2048
11
openssl pkcs8 -inform PEM -outform PEM -in node-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-key.pem
12
openssl req -new -key node-key.pem -out node.csr \
13
  -subj "/C=US/ST=State/L=City/O=Company/OU=IT/CN=*.opensearch.company.com"
14

15
# Sign certificate
16
openssl x509 -req -in node.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out node.pem -days 3650
17

18
# Set permissions
19
chmod 600 *-key.pem
20
chmod 644 *.pem

1
#!/bin/bash
2
# System performance tuning for OpenSearch
3

4
# Disable swap
5
sudo swapoff -a
6
sudo sed -i '/ swap / s/^/#/' /etc/fstab
7

8
# Set vm.max_map_count
9
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
10

11
# Set file descriptors
12
echo "* soft nofile 65535" | sudo tee -a /etc/security/limits.conf
13
echo "* hard nofile 65535" | sudo tee -a /etc/security/limits.conf
14
echo "* soft nproc 4096" | sudo tee -a /etc/security/limits.conf
15
echo "* hard nproc 4096" | sudo tee -a /etc/security/limits.conf
16

17
# Set memlock for opensearch user
18
echo "opensearch soft memlock unlimited" | sudo tee -a /etc/security/limits.conf
19
echo "opensearch hard memlock unlimited" | sudo tee -a /etc/security/limits.conf
20

21
# Apply sysctl settings
22
sudo sysctl -p
23

24
# Configure transparent huge pages
25
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
26
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/defrag
27

28
# Create systemd drop-in for OpenSearch
29
sudo mkdir -p /etc/systemd/system/opensearch.service.d
30
cat <<EOF | sudo tee /etc/systemd/system/opensearch.service.d/override.conf
31
[Service]
32
LimitNOFILE=65535
33
LimitNPROC=4096
34
LimitMEMLOCK=infinity
35
EOF
36

37
sudo systemctl daemon-reload

1
{
2
  "settings": {
3
    "index": {
4
      "number_of_shards": 3,
5
      "number_of_replicas": 1,
6
      "refresh_interval": "30s",
7
      "translog": {
8
        "durability": "async",
9
        "sync_interval": "30s",
10
        "flush_threshold_size": "512mb"
11
      },
12
      "merge": {
13
        "scheduler": {
14
          "max_thread_count": 1
15
        },
16
        "policy": {
17
          "max_merged_segment": "5gb"
18
        }
19
      },
20
      "unassigned": {
21
        "node_left": {
22
          "delayed_timeout": "5m"
23
        }
24
      }
25
    },
26
    "analysis": {
27
      "analyzer": {
28
        "default": {
29
          "type": "standard",
30
          "stopwords": "_english_"
31
        }
32
      }
33
    }
34
  },
35
  "mappings": {
36
    "properties": {
37
      "@timestamp": {
38
        "type": "date"
39
      },
40
      "message": {
41
        "type": "text",
42
        "fields": {
43
          "keyword": {
44
            "type": "keyword",
45
            "ignore_above": 256
46
          }
47
        }
48
      }
49
    }
50
  }
51
}

1
# Enable monitoring APIs
2
http.detailed_errors.enabled: true
3
rest.action.multi.allow_explicit_index: true
4

5
# Monitoring settings
6
monitoring.enabled: true
7
monitoring.collection.enabled: true
8
monitoring.collection.interval: 10s
9
monitoring.history.duration: 7d

1
{
2
  "trigger": {
3
    "schedule": {
4
      "interval": {
5
        "period": 1,
6
        "unit": "MINUTES"
7
      }
8
    }
9
  },
10
  "input": {
11
    "search": {
12
      "request": {
13
        "indices": [".opensearch-cluster-stats*"],
14
        "body": {
15
          "query": {
16
            "bool": {
17
              "filter": [
18
                {
19
                  "range": {
20
                    "@timestamp": {
21
                      "gte": "now-5m"
22
                    }
23
                  }
24
                },
25
                {
26
                  "range": {
27
                    "nodes.jvm.mem.heap_used_percent": {
28
                      "gte": 90
29
                    }
30
                  }
31
                }
32
              ]
33
            }
34
          }
35
        }
36
      }
37
    }
38
  },
39
  "condition": {
40
    "compare": {
41
      "ctx.payload.hits.total.value": {
42
        "gt": 0
43
      }
44
    }
45
  },
46
  "actions": {
47
    "send_email": {
48
      "email": {
49
        "to": ["ops-team@company.com"],
50
        "subject": "High JVM Memory Usage Alert",
51
        "body": "OpenSearch cluster is experiencing high JVM memory usage (>90%)"
52
      }
53
    }
54
  }
55
}

1
{
2
  "policy": {
3
    "description": "Hot-Warm-Cold architecture policy",
4
    "default_state": "hot",
5
    "states": [
6
      {
7
        "name": "hot",
8
        "actions": [
9
          {
10
            "rollover": {
11
              "min_size": "50gb",
12
              "min_index_age": "7d"
13
            }
14
          }
15
        ],
16
        "transitions": [
17
          {
18
            "state_name": "warm",
19
            "conditions": {
20
              "min_index_age": "7d"
21
            }
22
          }
23
        ]
24
      },
25
      {
26
        "name": "warm",
27
        "actions": [
28
          {
29
            "replica_count": {
30
              "number_of_replicas": 1
31
            }
32
          },
33
          {
34
            "shrink": {
35
              "number_of_shards": 1
36
            }
37
          },
38
          {
39
            "allocation": {
40
              "require": {
41
                "temp": "warm"
42
              }
43
            }
44
          }
45
        ],
46
        "transitions": [
47
          {
48
            "state_name": "cold",
49
            "conditions": {
50
              "min_index_age": "30d"
51
            }
52
          }
53
        ]
54
      },
55
      {
56
        "name": "cold",
57
        "actions": [
58
          {
59
            "replica_count": {
60
              "number_of_replicas": 0
61
            }
62
          },
63
          {
64
            "allocation": {
65
              "require": {
66
                "temp": "cold"
67
              }
68
            }
69
          }
70
        ],
71
        "transitions": [
72
          {
73
            "state_name": "delete",
74
            "conditions": {
75
              "min_index_age": "90d"
76
            }
77
          }
78
        ]
79
      },
80
      {
81
        "name": "delete",
82
        "actions": [
83
          {
84
            "delete": {}
85
          }
86
        ]
87
      }
88
    ]
89
  }
90
}