---
title: "OpenSearch integration | Grafana Cloud documentation"
description: "Learn about OpenSearch Grafana Cloud integration."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# OpenSearch integration for Grafana Cloud

OpenSearch is an open-source project and a fork of Elasticsearch that provides a fully-featured and compatible alternative. It uses the same core technologies as Elasticsearch, including the Lucene search engine, and offers similar features such as distributed search, indexing, and analytics. This integration for Grafana Cloud allows users to monitor an OpenSearch clustered deployment with 3 separate dashboards for visualizing metric details at the cluster, node, and index levels.

This integration supports OpenSearch version 2.5.0+  
This integration supports Prometheus exporter plugin for OpenSearch version 2.5.0.0+

This integration includes 12 useful alerts and 4 pre-built dashboards to help monitor and visualize OpenSearch metrics and logs.

## Before you begin

In order for the integration to properly work, you must set up the [Prometheus Exporter Plugin for OpenSearch](https://github.com/aiven/prometheus-exporter-plugin-for-opensearch).

#### Set up Prometheus Exporter Plugin for OpenSearch

To ensure compatibility, it is recommended that you refer to the [Prometheus exporter plugins compatibility matrix](https://github.com/aiven/prometheus-exporter-plugin-for-opensearch#compatibility-matrix) and download the appropriate version based on your OpenSearch version.

You can find where to install the OpenSearch Prometheus exporter plugin by running:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
sudo find / -name opensearch-plugin
```

This should give a location like `/usr/share/opensearch/bin/opensearch-plugin` which you can then change directory into with `cd /usr/share/opensearch`.

The Prometheus Exporter for OpenSearch version 2.5.0 can be installed via:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
./bin/opensearch-plugin install https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/2.5.0.0/prometheus-exporter-2.5.0.0.zip
```

For more information on how to configure the Prometheus exporter plugin on each node, please refer to the [Plugin Configuration documentation](https://github.com/aiven/prometheus-exporter-plugin-for-opensearch#plugin-configuration) for further configuration details.

To validate the plugin is working correctly, Prometheus metrics should be available locally via curl:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
curl http://localhost:9200/_prometheus/metrics
```

If you are unable to collect Prometheus metrics, then the OpenSearch configuration needs to be updated. This can be achieved by editing `/etc/opensearch/opensearch.yml` config.

To get running quickly, add `plugins.security.disabled: true` to the bottom of the file. Once this is done, OpenSearch can be restarted with `sudo systemctl restart opensearch`. Validate that Prometheus metrics can be collected via curl.

## Install OpenSearch integration for Grafana Cloud

1. In your Grafana Cloud stack, click **Connections** in the left-hand menu.
2. Find **OpenSearch** and click its tile to open the integration.
3. Review the prerequisites in the **Configuration Details** tab and set up Grafana Alloy to send OpenSearch metrics and logs to your Grafana Cloud instance.
4. Click **Install** to add this integration’s pre-built dashboards and alerts to your Grafana Cloud instance, and you can start monitoring your OpenSearch setup.

## Configuration snippets for Grafana Alloy

### Advanced mode

The following snippets provide examples to guide you through the configuration process.

To instruct Grafana Alloy to scrape your OpenSearch instances, **manually** copy and append the snippets to your alloy configuration file, then follow subsequent instructions.

> ##### **Note on the exporter plugin**
> 
> The Prometheus exporter plugin provides the label `cluster` on the metrics, which represents the name given to the OpenSearch cluster. The mixin is looking for `opensearch_cluster` and the configuration snippets will include rules for creating the `opensearch_cluster` label and dropping the `cluster` label.

### Advanced metrics snippets

Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```alloy
discovery.relabel "metrics_integrations_integrations_opensearch" {
	targets = [{
		__address__ = "<your-host-name>:9200",
	}]

	rule {
		target_label = "node"
		replacement  = constants.hostname
	}
}

prometheus.scrape "metrics_integrations_integrations_opensearch" {
	targets      = discovery.relabel.metrics_integrations_integrations_opensearch.output
	forward_to   = [prometheus.relabel.metrics_integrations_integrations_opensearch.receiver]
	job_name     = "integrations/opensearch"
	metrics_path = "/_prometheus/metrics"
}

prometheus.relabel "metrics_integrations_integrations_opensearch" {
	forward_to = [prometheus.remote_write.metrics_service.receiver]

  rule {
    action      = "labelmap"
    regex       = "cluster"
    replacement = "opensearch_cluster"
  }

  rule {
    action = "labeldrop"
    regex  = "cluster"
  }

  // Asserts-specific rules
  rule {
    target_label = "instance"
    replacement  = constants.hostname
  }

  // this should either be
  // 1. k8s deployment name
  // 2. opensearch_cluster name in case of non-k8s environment
  rule {
    target_label = "service"
    replacement = <service-name>
  }

  // this should either be
  // 1. k8s deployment name
  // 2. opensearch_cluster name in case of non-k8s environment
  rule {
    target_label = "workload"
    replacement = <workload-name>
  }

  // k8s-specific rules
  rule {
    target_label = "namespace"
    replacement  = <k8s-namespace>
  }

  rule {
    target_label = "pod"
    replacement  = constants.hostname
  }
}
```

To monitor your OpenSearch instance, you must use a [discovery.relabel](/docs/alloy/latest/reference/components/discovery.relabel/) component to discover your OpenSearch Prometheus endpoint and apply appropriate labels, followed by a [prometheus.scrape](/docs/alloy/latest/reference/components/prometheus.scrape) component to scrape it.

Configure the following properties within each `discovery.relabel` component:

- `__address__`: The address to your OpenSearch Prometheus metrics endpoint.
- `node` label: `constants.hostname` sets the `instance` label to your Grafana Alloy server hostname. If that is not suitable, change it to a value uniquely identifies this OpenSearch instance. Make sure this label value is the same for all telemetry data collected for this instance.
- `opensearch_cluster` label: The name of your OpenSearch cluster. This value should be set by the configuration using `labelmap` and `labeldrop` instructions. The value originates from the `cluster.name` setting in the OpenSearch configuration.

If you have multiple OpenSearch servers to scrape, configure one `discovery.relabel` for each and scrape them by including each under `targets` within the `prometheus.scrape` component.

### Advanced logs snippets

#### linux

Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```alloy
local.file_match "logs_integrations_integrations_opensearch" {
  path_targets = [{
    __address__        = "localhost",
    __path__           = "/var/log/opensearch/opensearch.log",
    job                = "integrations/opensearch",
    opensearch_cluster = "<your-cluster-name>",
    node               = constants.hostname,
  }]
}

loki.source.file "logs_integrations_integrations_opensearch" {
  targets    = local.file_match.logs_integrations_integrations_opensearch.targets
  forward_to = [loki.write.grafana_cloud_loki.receiver]
}
```

To monitor your OpenSearch instance logs, you will use a combination of the following components:

- [local.file\_match](/docs/alloy/latest/reference/components/local.file_match) defines where to find the log file to be scraped. Change the following properties according to your environment:
  
  - `__address__`: The OpenSearch instance address
  - `__path__`: The path to the log file.
  - `node` label: `constants.hostname` sets the `instance` label to your Grafana Alloy server hostname. If that is not suitable, change it to a value uniquely identifies this OpenSearch instance. Make sure this label value is the same for all telemetry data collected for this instance.
  - `opensearch_cluster` label: The name of your OpenSearch cluster.
- [loki.source.file](/docs/alloy/latest/reference/components/loki.source.file) sends logs to Loki.

On Linux, you will also need to add the `alloy` user to the `opensearch` group to get logs. Run the following command to configure the user as required:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
sudo usermod -a -G opensearch alloy
```

## Kubernetes instructions

Instructions for Kubernetes

### Before you begin with Kubernetes

**Please note**: These instructions assume the use of the [Kubernetes Monitoring Helm chart](https://github.com/grafana/k8s-monitoring-helm)

In order for the integration to properly work, you must set up the [Prometheus Exporter Plugin for OpenSearch](https://github.com/aiven/prometheus-exporter-plugin-for-opensearch).

#### Set up Prometheus Exporter Plugin for OpenSearch

To ensure compatibility, it is recommended that you refer to the [Prometheus exporter plugins compatibility matrix](https://github.com/aiven/prometheus-exporter-plugin-for-opensearch#compatibility-matrix) and download the appropriate version based on your OpenSearch version.

You can find where to install the OpenSearch Prometheus exporter plugin by running:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
sudo find / -name opensearch-plugin
```

This should give a location like `/usr/share/opensearch/bin/opensearch-plugin` which you can then change directory into with `cd /usr/share/opensearch`.

The Prometheus Exporter for OpenSearch version 2.5.0 can be installed via:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
./bin/opensearch-plugin install https://github.com/aiven/prometheus-exporter-plugin-for-opensearch/releases/download/2.5.0.0/prometheus-exporter-2.5.0.0.zip
```

For more information on how to configure the Prometheus exporter plugin on each node, please refer to the [Plugin Configuration documentation](https://github.com/aiven/prometheus-exporter-plugin-for-opensearch#plugin-configuration) for further configuration details.

To validate the plugin is working correctly, Prometheus metrics should be available locally via curl:

sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```sh
curl http://localhost:9200/_prometheus/metrics
```

If you are unable to collect Prometheus metrics, then the OpenSearch configuration needs to be updated. This can be achieved by editing `/etc/opensearch/opensearch.yml` config.

To get running quickly, add `plugins.security.disabled: true` to the bottom of the file. Once this is done, OpenSearch can be restarted with `sudo systemctl restart opensearch`. Validate that Prometheus metrics can be collected via curl.

### Configuration snippets for Kubernetes Helm chart

The following snippets provide examples to guide you through the configuration process.

To scrape your OpenSearch instances, **manually** modify your Kubernetes Monitoring Helm chart with these configuration snippets.

Replace any values between the angle brackets `<>` in the provided snippets with your desired configuration values.

#### Metrics snippets

Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```alloy
alloy-metrics:
    extraConfig: |-
        discovery.kubernetes "opensearch_metrics" {
            role = "pod"
            selectors {
                role = "pod"
                label = "<opensearch_pod_label_name>=<opensearch_pod_label_value>"
            }
        }

        discovery.relabel "opensearch_metrics" {
            targets = discovery.kubernetes.opensearch_metrics.targets
        
            rule {
                source_labels = ["__address__"]
                regex         = "([^:]+)(:[0-9]+)?"
                target_label  = "instance"
                replacement   = "\${1}"
            }
        }
        
        prometheus.scrape "opensearch_metrics" {
            targets      = discovery.relabel.opensearch_metrics.output
            metrics_path = "/monitoring/prometheus/metrics"
            job_name     = "integrations/opensearch"
            forward_to   = [prometheus.relabel.integrations_opensearch_cluster_label.receiver]
        }
        
        prometheus.relabel "integrations_opensearch_cluster_label" {
            rule {
                action      = "labelmap"
                regex       = "cluster"
                replacement = "opensearch_cluster"
            }
        
            rule {
                action = "labeldrop"
                regex  = "cluster"
            }

            forward_to = [prometheus.remote_write.grafana_cloud_metrics.receiver]
        }
```

#### Logs snippets

Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```alloy
podLogs:
    extraDiscoveryRules: |-
        rule {
            source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_name"]
            separator     = ":"
            regex         = "(<opensearch_namespace>:opensearch.*)"
            replacement   = "opensearch"
            target_label  = "integration"
        }

        rule {
            source_labels = ["integration", "__meta_kubernetes_pod_ip"]
            separator = ":"
            regex = "opensearch:(.*)"
            target_label = "instance"
        }

        rule {
            source_labels = ["integration", "__meta_kubernetes_pod_node_name"]
            separator = ":"
            regex = "opensearch:(.*)"
            target_label = "node"
        }

        rule {
            source_labels = ["integration"]
            regex = "opensearch"
            replacement = "integrations/opensearch"
            target_label = "job"
        }

        rule {
            source_labels = ["integration"]
            regex = "opensearch"
            replacement = "<your-opensearch-cluster-name>"
            target_label = "opensearch_cluster"
        }
```

## Dashboards

The OpenSearch integration installs the following dashboards in your Grafana Cloud instance to help monitor your system.

- OpenSearch cluster overview
- OpenSearch logs
- OpenSearch node overview
- OpenSearch search and index overview

**OpenSearch Cluster Overview Dashboard 1**

**OpenSearch Node Overview Dashboard 1**

**OpenSearch Search and Index Overview Dashboard 1**

## Alerts

The OpenSearch integration includes the following useful alerts:

Expand table

| Alert                               | Description                                                                              |
|-------------------------------------|------------------------------------------------------------------------------------------|
| OpenSearchYellowCluster             | Warning: At least one of the clusters is reporting a yellow status.                      |
| OpenSearchRedCluster                | Critical: At least one of the clusters is reporting a red status.                        |
| OpenSearchUnstableShardReallocation | Warning: A node has gone offline or has been disconnected triggering shard reallocation. |
| OpenSearchUnstableShardUnassigned   | Warning: There are shards that have been detected as unassigned.                         |
| OpenSearchHighNodeDiskUsage         | Warning: The node disk usage has exceeded the warning threshold.                         |
| OpenSearchHighNodeDiskUsage         | Critical: The node disk usage has exceeded the critical threshold.                       |
| OpenSearchHighNodeCpuUsage          | Warning: The node CPU usage has exceeded the warning threshold.                          |
| OpenSearchHighNodeCpuUsage          | Critical: The node CPU usage has exceeded the critical threshold.                        |
| OpenSearchHighNodeMemoryUsage       | Warning: The node memory usage has exceeded the warning threshold.                       |
| OpenSearchHighNodeMemoryUsage       | Critical: The node memory usage has exceeded the critical threshold.                     |
| OpenSearchModerateRequestLatency    | Warning: The request latency has exceeded the warning threshold.                         |
| OpenSearchModerateIndexLatency      | Warning: The index latency has exceeded the warning threshold.                           |

## Metrics

The most important metrics provided by the OpenSearch integration, which are used on the pre-built dashboards and Prometheus alerts, are as follows:

- opensearch\_circuitbreaker\_tripped\_count
- opensearch\_cluster\_datanodes\_number
- opensearch\_cluster\_nodes\_number
- opensearch\_cluster\_pending\_tasks\_number
- opensearch\_cluster\_shards\_active\_percent
- opensearch\_cluster\_shards\_number
- opensearch\_cluster\_status
- opensearch\_cluster\_task\_max\_waiting\_time\_seconds
- opensearch\_fs\_io\_total\_read\_bytes
- opensearch\_fs\_io\_total\_write\_bytes
- opensearch\_fs\_path\_free\_bytes
- opensearch\_fs\_path\_total\_bytes
- opensearch\_index\_fielddata\_evictions\_count
- opensearch\_index\_flush\_total\_count
- opensearch\_index\_flush\_total\_time\_seconds
- opensearch\_index\_indexing\_delete\_current\_number
- opensearch\_index\_indexing\_index\_count
- opensearch\_index\_indexing\_index\_current\_number
- opensearch\_index\_indexing\_index\_failed\_count
- opensearch\_index\_indexing\_index\_time\_seconds
- opensearch\_index\_merges\_current\_size\_bytes
- opensearch\_index\_merges\_total\_docs\_count
- opensearch\_index\_merges\_total\_stopped\_time\_seconds
- opensearch\_index\_merges\_total\_throttled\_time\_seconds
- opensearch\_index\_merges\_total\_time\_seconds
- opensearch\_index\_querycache\_evictions\_count
- opensearch\_index\_querycache\_hit\_count
- opensearch\_index\_querycache\_memory\_size\_bytes
- opensearch\_index\_querycache\_miss\_number
- opensearch\_index\_refresh\_total\_count
- opensearch\_index\_refresh\_total\_time\_seconds
- opensearch\_index\_requestcache\_evictions\_count
- opensearch\_index\_requestcache\_hit\_count
- opensearch\_index\_requestcache\_memory\_size\_bytes
- opensearch\_index\_requestcache\_miss\_count
- opensearch\_index\_search\_fetch\_count
- opensearch\_index\_search\_fetch\_current\_number
- opensearch\_index\_search\_fetch\_time\_seconds
- opensearch\_index\_search\_query\_count
- opensearch\_index\_search\_query\_current\_number
- opensearch\_index\_search\_query\_time\_seconds
- opensearch\_index\_search\_scroll\_count
- opensearch\_index\_search\_scroll\_current\_number
- opensearch\_index\_search\_scroll\_time\_seconds
- opensearch\_index\_segments\_memory\_bytes
- opensearch\_index\_segments\_number
- opensearch\_index\_shards\_number
- opensearch\_index\_store\_size\_bytes
- opensearch\_index\_translog\_operations\_number
- opensearch\_indices\_indexing\_index\_count
- opensearch\_indices\_store\_size\_bytes
- opensearch\_jvm\_bufferpool\_number
- opensearch\_jvm\_bufferpool\_total\_capacity\_bytes
- opensearch\_jvm\_bufferpool\_used\_bytes
- opensearch\_jvm\_gc\_collection\_count
- opensearch\_jvm\_gc\_collection\_time\_seconds
- opensearch\_jvm\_mem\_heap\_committed\_bytes
- opensearch\_jvm\_mem\_heap\_used\_bytes
- opensearch\_jvm\_mem\_nonheap\_committed\_bytes
- opensearch\_jvm\_mem\_nonheap\_used\_bytes
- opensearch\_jvm\_threads\_number
- opensearch\_jvm\_uptime\_seconds
- opensearch\_node\_role\_bool
- opensearch\_os\_cpu\_percent
- opensearch\_os\_mem\_used\_percent
- opensearch\_os\_swap\_free\_bytes
- opensearch\_os\_swap\_used\_bytes
- opensearch\_threadpool\_tasks\_number
- opensearch\_threadpool\_threads\_number
- opensearch\_transport\_rx\_bytes\_count
- opensearch\_transport\_server\_open\_number
- opensearch\_transport\_tx\_bytes\_count
- up

## Changelog

md ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```md
# 1.2.0 - April 2026

* Updated dashboards to follow new stylistic standards

# 1.1.0 - April 2025

* Add Asserts support. Alloy metrics configuration was updated to include Asserts-specific labels.

# 1.0.0 - September 2024

* Update alert names

# 0.0.2 - August 2023

* Add regex filter for logs datasource

# 0.0.1 - May 2023

* Initial release
```

## Cost

By connecting your OpenSearch instance to Grafana Cloud, you might incur charges. To view information on the number of active series that your Grafana Cloud account uses for metrics included in each Cloud tier, see [Active series and dpm usage](/docs/grafana-cloud/fundamentals/active-series-and-dpm/) and [Cloud tier pricing](/products/cloud/pricing/).