Production Deployment Guide: OpenSearch Dashboards Service#

Overview#

OpenSearch Dashboards is a powerful visualization tool for OpenSearch data. In a production environment, it is critical to run OpenSearch Dashboards as a managed systemd service with the proper permissions and configuration. This guide details how to configure the service, set up SSL (HTTPS on port 443), and resolve common permission issues that may arise during deployment.

Prerequisites#

Before proceeding with the deployment, ensure you have:

• A Linux server with OpenSearch Dashboards installed (using Tarball/RPM/Debian/Helm)
• Root access or sudo privileges
• SSL certificates (PEM format) available at the specified paths
• The opensearch-dashboards user is already created

If the opensearch-dashboards user doesn’t exist, create it with:

1
sudo useradd -r -s /sbin/nologin opensearch-dashboards

You’ll also need:

• OpenSearch Dashboards installation directory (default: /usr/share/opensearch-dashboards)
• Configuration directory (default: /etc/opensearch-dashboards)

Directory and File Permissions#

Proper permissions are crucial for security and functionality. Follow these steps to set up the necessary permissions:

1
sudo chown -R opensearch-dashboards:opensearch-dashboards /usr/share/opensearch-dashboards
2
sudo chown -R opensearch-dashboards:opensearch-dashboards /etc/opensearch-dashboards

1
sudo mkdir -p /usr/share/opensearch-dashboards/data
2
sudo chown -R opensearch-dashboards:opensearch-dashboards /usr/share/opensearch-dashboards/data
3
sudo chmod -R 755 /usr/share/opensearch-dashboards/data

Configuration File#

Edit the main configuration file located at /etc/opensearch-dashboards/opensearch_dashboards.yml. Below is an example configuration for a production environment:

1
server.host: "0.0.0.0"
2
server.port: 443
3
server.ssl.enabled: true
4
server.ssl.certificate: "/etc/opensearch-dashboards/certs/dashboard.pem"
5
server.ssl.key: "/etc/opensearch-dashboards/certs/dashboard-key.pem"
6

7
opensearch.hosts:
8
  [
9
    "https://172.17.14.79:9200",
10
    "https://172.17.14.89:9200",
11
    "https://172.17.14.39:9200",
12
  ]
13
opensearch.ssl.verificationMode: certificate
14
opensearch.username: "admin"
15
opensearch.password: "Anubhav@321"
16
opensearch.requestHeadersAllowlist: ["securitytenant", "Authorization"]
17

18
opensearch_security.multitenancy.enabled: false
19
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
20

21
uiSettings.overrides.defaultRoute: "/app/invinsense"

Important Notes:

• Ensure the certificate files exist and are accessible by the opensearch-dashboards user
• Replace the OpenSearch hosts with your actual OpenSearch cluster nodes
• Update credentials to match your environment’s security configuration
• Consider storing passwords in a secure vault rather than in plaintext for production

Systemd Service File Configuration#

Create (or modify) the systemd service file at /etc/systemd/system/opensearch-dashboards.service with the following content:

1
[Unit]
2
Description=OpenSearch Dashboards
3
Documentation=https://opensearch.org/docs/
4
Wants=network-online.target
5
After=network-online.target
6

7
[Service]
8
Type=simple
9
User=opensearch-dashboards
10
Group=opensearch-dashboards
11
Environment=NODE_ENV=production
12
WorkingDirectory=/usr/share/opensearch-dashboards
13
ExecStart=/usr/share/opensearch-dashboards/bin/opensearch-dashboards
14
Restart=on-failure
15
StandardOutput=journal
16
StandardError=inherit
17
LimitNOFILE=65535
18

19
[Install]
20
WantedBy=multi-user.target

Key Configuration Points:

• User and Group: The service runs as the opensearch-dashboards user
• WorkingDirectory: Must be set to the installation directory
• ExecStart: Path to the OpenSearch Dashboards startup script
• Restart: Set to restart on failure for improved reliability
• LimitNOFILE: Increased file descriptor limit for production workloads

After saving the file, reload systemd:

1
sudo systemctl daemon-reload

Then enable and start the service:

1
sudo systemctl enable opensearch-dashboards.service
2
sudo systemctl start opensearch-dashboards.service

Reloading and Restarting the Service#

After updating configurations or permissions, always reload the systemd daemon:

1
sudo systemctl daemon-reload

Then restart the service:

1
sudo systemctl restart opensearch-dashboards.service

Verify service status:

1
sudo systemctl status opensearch-dashboards.service

Troubleshooting UUID File Write Errors#

A common error when starting OpenSearch Dashboards is: