OpenSearch as an Elasticsearch Alternative: Migration and Setup

OpenSearch as an Elasticsearch Alternative: Migration and Setup

Your Elasticsearch cluster is running on SSPL licensing, and you're looking for a cost-effective alternative without sacrificing features. After Elasticsearch switched to the SSPL license, AWS forked the last open-source version (7.10) and created OpenSearch under Apache 2.0. It maintains full API compatibility but adds built-in security: TLS, RBAC, audit — all free, without buying X-Pack. For production, this is a direct replacement that can save up to 70% on licensing costs.

We have deployed dozens of OpenSearch clusters for clients, from startups to enterprise. In one project, we migrated 2 TB of logs from Elasticsearch 6.8 to OpenSearch 2.12 in four days. The main reindex took two hours; the rest was testing and fine-tuning ISM. According to the OpenSearch documentation, ISM is fully compatible with Elasticsearch ILM.

How ISM Manages Index Lifecycle

ISM (Index State Management) is the equivalent of ILM in Elasticsearch. A policy manages the lifecycle: hot → warm → delete. Here's an example for log indices:

PUT _plugins/_ism/policies/logs-policy
{
  "policy": {
    "description": "Log retention policy",
    "default_state": "hot",
    "states": [
      {
        "name": "hot",
        "actions": [
          {
            "rollover": {
              "min_index_age": "1d",
              "min_primary_shard_size": "50gb"
            }
          }
        ],
        "transitions": [
          {
            "state_name": "warm",
            "conditions": {
              "min_index_age": "7d"
            }
          }
        ]
      },
      {
        "name": "warm",
        "actions": [
          {
            "force_merge": {
              "max_num_segments": 1
            }
          },
          {
            "replica_count": {
              "number_of_replicas": 0
            }
          }
        ],
        "transitions": [
          {
            "state_name": "delete",
            "conditions": {
              "min_index_age": "30d"
            }
          }
        ]
      },
      {
        "name": "delete",
        "actions": [
          {
            "delete": {}
          }
        ],
        "transitions": []
      }
    ],
    "ism_template": [
      {
        "index_patterns": ["logs-*"],
        "priority": 100
      }
    ]
  }
}

The policy automatically rolls over indices when the primary shard exceeds 50 GB or age exceeds one day. After seven days, it force-merges to one segment and removes replicas. After 30 days, the index is deleted.

Deployment via Docker Compose

# docker-compose.yml
version: '3'
services:
  opensearch-node1:
    image: opensearchproject/opensearch:2.12.0
    container_name: opensearch-node1
    environment:
      - cluster.name=opensearch-cluster
      - node.name=opensearch-node1
      - discovery.seed_hosts=opensearch-node1,opensearch-node2
      - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
      - bootstrap.memory_lock=true
      - "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g"
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_ADMIN_PASSWORD}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - opensearch-data1:/usr/share/opensearch/data
    ports:
      - 9200:9200
      - 9600:9600
  opensearch-node2:
    image: opensearchproject/opensearch:2.12.0
    container_name: opensearch-node2
    environment:
      - cluster.name=opensearch-cluster
      - node.name=opensearch-node2
      - discovery.seed_hosts=opensearch-node1,opensearch-node2
      - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2
      - bootstrap.memory_lock=true
      - "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g"
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_ADMIN_PASSWORD}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - opensearch-data2:/usr/share/opensearch/data
  opensearch-dashboards:
    image: opensearchproject/opensearch-dashboards:2.12.0
    container_name: opensearch-dashboards
    ports:
      - 5601:5601
    environment:
      OPENSEARCH_HOSTS: '["https://opensearch-node1:9200","https://opensearch-node2:9200"]'
volumes:
  opensearch-data1:
  opensearch-data2:

This compose file brings up two nodes with port mappings for 9200 and 5601. Important: set the password via environment variable and include memlock in ulimits for stability.

Built-in Security Features

Unlike open-source Elasticsearch (without X-Pack), OpenSearch includes the Security plugin for free: TLS, RBAC, audit logging, LDAP/SAML integration. Here's an example role configuration:

---
# roles.yml
log_reader:
  cluster_permissions:
    - 'cluster:monitor/health'
  index_permissions:
    - index_patterns:
        - 'logs-*'
      allowed_actions:
        - 'read'
        - 'indices:monitor/stats'

For production, always enable TLS, configure RBAC for service accounts, and turn on auditing.

How We Migrate from Elasticsearch to OpenSearch

Migration consists of three phases:

1. Audit – Compare versions and plugins, check custom plugin compatibility.
2. Data transfer – Use reindex or snapshot/restore.
3. Client switch – Change the endpoint in application configs.

Example reindex in Python:

from opensearchpy import OpenSearch
client = OpenSearch(['http://old-elastic:9200'])
reindex_body = {
    "source": {"index": "old_index"},
    "dest": {"index": "new_index", "host": "http://new-opensearch:9200"}
}
client.reindex(body=reindex_body)

In practice, migrating a 1 TB index takes 2–3 hours depending on network and hardware. Contact us for a preliminary assessment of your project – we'll design the optimal migration plan.

Migration Phases from Elasticsearch to OpenSearch

Cost is determined per project based on data volume and infrastructure complexity. Get a consultation – we'll provide an accurate estimate.

Comparison: OpenSearch vs Elasticsearch

OpenSearch is 2–3 times cheaper in production due to the absence of paid security licenses. Licensing savings can reach 70% of infrastructure costs. Stability is equal – we operate clusters with 99.99% uptime.

What's Included in Our Work

• Audit of current Elasticsearch infrastructure (version, plugins, load)
• Deployment of OpenSearch cluster (3+ nodes) with ISM and Security
• Data migration with minimal downtime (snapshot → reindex)
• Configuration of OpenSearch Dashboards and monitoring (Prometheus + Grafana)
• Documentation (runbook, policies, network diagrams)
• Training for your team (2–3 sessions)
• One month of post-launch support

Timeline: 3 to 7 days for a cluster up to 10 nodes. Cost is determined individually. Request an audit of your system – contact us.

Why Trust Us with Your Migration?

We are a team of DevOps engineers with over a decade of production experience with search systems. We have completed 50+ migration projects from Elasticsearch to OpenSearch for banks, e-commerce, and SaaS companies. All clusters run under loads up to 100,000 queries per second.

We guarantee full API compatibility, zero data loss, and a step-by-step rollback plan. Get a consultation for your project – contact us.