OpenSearch

Limitations

• JVM memory tuning requires hands-on oversight; exceeding the 32 GB compressed pointer threshold causes memory penalties, and heavy aggregations risk garbage collection pauses.
• Client ecosystem fragmentation demands code refactoring; official Elastic client libraries reject OpenSearch clusters, requiring migration to community drivers such as opensearch-py.
• Major version upgrades encounter index compatibility blockers; indices from older engine releases cannot be mounted directly in OpenSearch 3.x without reindexing.
• Dense vector graphs demand extensive off-heap RAM; unoptimized HNSW indices can exhaust system memory and trigger shard dropouts during peak indexing.

Who should use it

• DevOps engineers operating large-scale log pipelines who want to eliminate subscription costs by running clusters on Kubernetes or cloud instances.
• Developers building application search who require fast full-text filtering and dense vector retrieval without paying per-query API fees.
• Infrastructure architects under data governance mandates who need complete on-premises control over index data and access policies.

FAQ

How does OpenSearch differ from Elasticsearch Service on operational cost? OpenSearch removes subscription fees and feature gates, so bills reflect only raw cloud or server infrastructure. In exchange, engineering teams handle JVM tuning, shard balancing, and operational maintenance.

Can OpenSearch serve as a drop-in replacement for Elasticsearch? OpenSearch is wire-compatible with Elasticsearch 7.10 APIs, but subsequent engine divergence and upstream client checks require switching application libraries to OpenSearch SDKs. Upgrades to 3.x also require reindexing legacy data.

Is OpenSearch free for commercial use? Yes, OpenSearch carries no usage limits, paid tiers, or seat fees for commercial deployments. Organizations can run it internally or embed it into products without software royalties.

Verdict

OpenSearch is the right choice for engineering teams with the operational capacity to manage distributed search infrastructure who want to eliminate subscription costs on high-volume workloads. It is not suitable for small teams seeking a hands-off search API that runs without cluster maintenance or JVM oversight. Backed by active commits throughout 2026 and distributed under the permissive Apache-2.0 terms, it provides long-term stability for organizations demanding complete control over their search platform.

Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 94 s: opensearchproject/opensearch:3.9.0.

Based on the upstream setup. Official Docker Compose setup adapted to single-node: dropped OpenSearch Dashboards and the second node. Pinned image to 3.9.0, bound port 9200 to 127.0.0.1 with generated admin password in .env. Setting plugins.security.ssl.http.enabled=false removes HTTP TLS, so Basic-auth credentials are sent in cleartext and must only travel over loopback, an SSH tunnel or a TLS-terminating proxy.

opensearch-1  | 2026-11-01T06:08:33.771745130Z [2026-11-01T06:08:33,771][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index .opendistro_security.
opensearch-1  | 2026-11-01T06:08:33.771780255Z [2026-11-01T06:08:33,771][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index .opendistro_security with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:33.772313755Z [2026-11-01T06:08:33,772][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[.opendistro_security/s3Hms2KDQUCt0BU5bt42-w]
opensearch-1  | 2026-11-01T06:08:33.774179588Z [2026-11-01T06:08:33,774][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [.opendistro_security/s3Hms2KDQUCt0BU5bt42-w] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:33.796933255Z [2026-11-01T06:08:33,796][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Doc with id 'tenants' and version 2 is updated in .opendistro_security index.
opensearch-1  | 2026-11-01T06:08:33.797025088Z [2026-11-01T06:08:33,796][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Will update 'nodesdn' with /usr/share/opensearch/config/opensearch-security/nodes_dn.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=true
opensearch-1  | 2026-11-01T06:08:33.798768921Z [2026-11-01T06:08:33,798][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index .opendistro_security from [false] to [true]
opensearch-1  | 2026-11-01T06:08:33.798807171Z [2026-11-01T06:08:33,798][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index .opendistro_security.
opensearch-1  | 2026-11-01T06:08:33.798841296Z [2026-11-01T06:08:33,798][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index .opendistro_security with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:33.799204588Z [2026-11-01T06:08:33,799][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[.opendistro_security/s3Hms2KDQUCt0BU5bt42-w]
opensearch-1  | 2026-11-01T06:08:33.802115421Z [2026-11-01T06:08:33,802][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [.opendistro_security/s3Hms2KDQUCt0BU5bt42-w] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:33.821472963Z [2026-11-01T06:08:33,821][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Doc with id 'nodesdn' and version 2 is updated in .opendistro_security index.
opensearch-1  | 2026-11-01T06:08:33.821940130Z [2026-11-01T06:08:33,821][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Will update 'allowlist' with /usr/share/opensearch/config/opensearch-security/allowlist.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=true
opensearch-1  | 2026-11-01T06:08:33.823910463Z [2026-11-01T06:08:33,823][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index .opendistro_security from [false] to [true]
opensearch-1  | 2026-11-01T06:08:33.823951880Z [2026-11-01T06:08:33,823][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index .opendistro_security.
opensearch-1  | 2026-11-01T06:08:33.823986630Z [2026-11-01T06:08:33,823][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index .opendistro_security with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:33.824380838Z [2026-11-01T06:08:33,824][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[.opendistro_security/s3Hms2KDQUCt0BU5bt42-w]
opensearch-1  | 2026-11-01T06:08:33.826185838Z [2026-11-01T06:08:33,826][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [.opendistro_security/s3Hms2KDQUCt0BU5bt42-w] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:33.845098171Z [2026-11-01T06:08:33,844][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Doc with id 'allowlist' and version 2 is updated in .opendistro_security index.
opensearch-1  | 2026-11-01T06:08:33.845206505Z [2026-11-01T06:08:33,845][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Will update 'audit' with /usr/share/opensearch/config/opensearch-security/audit.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
opensearch-1  | 2026-11-01T06:08:33.857381880Z [2026-11-01T06:08:33,857][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index .opendistro_security from [false] to [true]
opensearch-1  | 2026-11-01T06:08:33.857435880Z [2026-11-01T06:08:33,857][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index .opendistro_security.
opensearch-1  | 2026-11-01T06:08:33.857461296Z [2026-11-01T06:08:33,857][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index .opendistro_security with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:33.857834046Z [2026-11-01T06:08:33,857][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[.opendistro_security/s3Hms2KDQUCt0BU5bt42-w]
opensearch-1  | 2026-11-01T06:08:33.861237671Z [2026-11-01T06:08:33,861][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [.opendistro_security/s3Hms2KDQUCt0BU5bt42-w] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:33.880391588Z [2026-11-01T06:08:33,880][INFO ][o.o.s.s.ConfigHelper     ] [opensearch-node] Doc with id 'audit' and version 2 is updated in .opendistro_security index.
opensearch-1  | 2026-11-01T06:08:33.912586421Z [2026-11-01T06:08:33,912][DEPRECATION][o.o.d.s.a.c.AuditConfig  ] [opensearch-node] Both 'disabled_categories' and 'disabled_rest_categories'/'disabled_transport_categories' are configured. They will work in tandem, but consider migrating to 'disabled_categories' only.
opensearch-1  | 2026-11-01T06:08:34.007583755Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing on REST API is enabled.
opensearch-1  | 2026-11-01T06:08:34.007598255Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] [AUTHENTICATED, GRANTED_PRIVILEGES] are excluded from REST API auditing.
opensearch-1  | 2026-11-01T06:08:34.007599213Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing on Transport API is enabled.
opensearch-1  | 2026-11-01T06:08:34.007599880Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] [AUTHENTICATED, GRANTED_PRIVILEGES, CLUSTER_SETTINGS_CHANGED, INDEX_SETTINGS_CHANGED] are excluded from Transport API auditing.
opensearch-1  | 2026-11-01T06:08:34.007600588Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing of request body is enabled.
opensearch-1  | 2026-11-01T06:08:34.007601296Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Bulk requests resolution is disabled during request auditing.
opensearch-1  | 2026-11-01T06:08:34.007601880Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Index resolution is enabled during request auditing.
opensearch-1  | 2026-11-01T06:08:34.007602505Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Sensitive headers exclusion from auditing is enabled.
opensearch-1  | 2026-11-01T06:08:34.007603046Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing requests from kibanaserver users is disabled.
opensearch-1  | 2026-11-01T06:08:34.007603630Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing request headers <NONE> is disabled.
opensearch-1  | 2026-11-01T06:08:34.007659421Z [2026-11-01T06:08:34,007][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing request url params <NONE> is disabled.
opensearch-1  | 2026-11-01T06:08:34.008819671Z [2026-11-01T06:08:34,008][WARN ][o.o.s.a.r.AuditMessageRouter] [opensearch-node] No endpoint configured for categories [BAD_HEADERS, FAILED_LOGIN, MISSING_PRIVILEGES, GRANTED_PRIVILEGES, OPENDISTRO_SECURITY_INDEX_ATTEMPT, SSL_EXCEPTION, AUTHENTICATED, INDEX_EVENT, COMPLIANCE_DOC_READ, COMPLIANCE_DOC_WRITE, COMPLIANCE_EXTERNAL_CONFIG, COMPLIANCE_INTERNAL_CONFIG_READ, COMPLIANCE_INTERNAL_CONFIG_WRITE, CLUSTER_SETTINGS_CHANGED, INDEX_SETTINGS_CHANGED, API_TOKEN_WRITE, REQUEST_AUDIT, TRANSPORT_AUDIT, RESOURCE_ACCESS_GRANTED, RESOURCE_ACCESS_DENIED, RESOURCE_SHARING_CHANGED], using default endpoint
opensearch-1  | 2026-11-01T06:08:34.008863546Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing of external configuration is disabled.
opensearch-1  | 2026-11-01T06:08:34.008894088Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing of internal configuration is enabled.
opensearch-1  | 2026-11-01T06:08:34.008914796Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing only metadata information for read request is enabled.
opensearch-1  | 2026-11-01T06:08:34.008934880Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing will watch {} for read requests.
opensearch-1  | 2026-11-01T06:08:34.008959671Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing read operation requests from kibanaserver users is disabled.
opensearch-1  | 2026-11-01T06:08:34.008980171Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing only metadata information for write request is enabled.
opensearch-1  | 2026-11-01T06:08:34.008996046Z [2026-11-01T06:08:34,008][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing diffs for write requests is disabled.
opensearch-1  | 2026-11-01T06:08:34.009018463Z [2026-11-01T06:08:34,009][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing write operation requests from kibanaserver users is disabled.
opensearch-1  | 2026-11-01T06:08:34.009053505Z [2026-11-01T06:08:34,009][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Auditing will watch <NONE> for write requests.
opensearch-1  | 2026-11-01T06:08:34.009160630Z [2026-11-01T06:08:34,009][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] .opendistro_security is used as internal security index.
opensearch-1  | 2026-11-01T06:08:34.009178046Z [2026-11-01T06:08:34,009][INFO ][o.o.s.a.i.AuditLogImpl   ] [opensearch-node] Internal index used for posting audit logs is null
opensearch-1  | 2026-11-01T06:08:34.009540380Z [2026-11-01T06:08:34,009][INFO ][o.o.s.c.ConfigurationRepository] [opensearch-node] Hot-reloading of audit configuration is enabled
opensearch-1  | 2026-11-01T06:08:34.009571338Z [2026-11-01T06:08:34,009][INFO ][o.o.s.c.ConfigurationRepository] [opensearch-node] Node 'opensearch-node' initialized
opensearch-1  | 2026-11-01T06:08:36.305791381Z [2026-11-01T06:08:36,305][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index test-index from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.305857297Z [2026-11-01T06:08:36,305][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index test-index.
opensearch-1  | 2026-11-01T06:08:36.305887089Z [2026-11-01T06:08:36,305][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index test-index with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.306234922Z [2026-11-01T06:08:36,306][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[test-index/iDvM1kQlSmSIO03poiJRAQ]
opensearch-1  | 2026-11-01T06:08:36.306991797Z [2026-11-01T06:08:36,306][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index test-index from [true] to [true]
opensearch-1  | 2026-11-01T06:08:36.308400839Z [2026-11-01T06:08:36,308][INFO ][o.o.c.m.MetadataCreateIndexService] [opensearch-node] [test-index] creating index, cause [api], templates [], shards [1]/[0]
opensearch-1  | 2026-11-01T06:08:36.319037297Z [2026-11-01T06:08:36,318][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index test-index from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.319077131Z [2026-11-01T06:08:36,319][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index test-index.
opensearch-1  | 2026-11-01T06:08:36.319183839Z [2026-11-01T06:08:36,319][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index test-index with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.319598756Z [2026-11-01T06:08:36,319][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[test-index/iDvM1kQlSmSIO03poiJRAQ]
opensearch-1  | 2026-11-01T06:08:36.320482422Z [2026-11-01T06:08:36,320][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index test-index from [true] to [true]
opensearch-1  | 2026-11-01T06:08:36.326989422Z [2026-11-01T06:08:36,326][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.327050339Z [2026-11-01T06:08:36,327][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.327084589Z [2026-11-01T06:08:36,327][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.327697756Z [2026-11-01T06:08:36,327][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.328630964Z [2026-11-01T06:08:36,328][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [true] to [true]
opensearch-1  | 2026-11-01T06:08:36.329244922Z [2026-11-01T06:08:36,329][INFO ][o.o.c.m.MetadataCreateIndexService] [opensearch-node] [security-auditlog-2026.11.01] creating index, cause [api], templates [], shards [1]/[1]
opensearch-1  | 2026-11-01T06:08:36.329528922Z [2026-11-01T06:08:36,329][INFO ][o.o.c.r.a.AllocationService] [opensearch-node] updating number_of_replicas to [0] for indices [security-auditlog-2026.11.01]
opensearch-1  | 2026-11-01T06:08:36.341027547Z [2026-11-01T06:08:36,340][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.341195506Z [2026-11-01T06:08:36,341][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.341223381Z [2026-11-01T06:08:36,341][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.341659131Z [2026-11-01T06:08:36,341][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.342337881Z [2026-11-01T06:08:36,342][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [true] to [true]
opensearch-1  | 2026-11-01T06:08:36.365948381Z [2026-11-01T06:08:36,365][INFO ][o.o.c.r.a.AllocationService] [opensearch-node] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[security-auditlog-2026.11.01][0]]]).
opensearch-1  | 2026-11-01T06:08:36.379199214Z [2026-11-01T06:08:36,379][INFO ][o.o.s.a.s.InternalOpenSearchSink] [opensearch-node] Created audit log index 'security-auditlog-2026.11.01'
opensearch-1  | 2026-11-01T06:08:36.384373297Z [2026-11-01T06:08:36,384][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index test-index from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.384409631Z [2026-11-01T06:08:36,384][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index test-index.
opensearch-1  | 2026-11-01T06:08:36.384442589Z [2026-11-01T06:08:36,384][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index test-index with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.384769381Z [2026-11-01T06:08:36,384][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[test-index/iDvM1kQlSmSIO03poiJRAQ]
opensearch-1  | 2026-11-01T06:08:36.385875964Z [2026-11-01T06:08:36,385][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [test-index/iDvM1kQlSmSIO03poiJRAQ] create_mapping
opensearch-1  | 2026-11-01T06:08:36.399412339Z [2026-11-01T06:08:36,399][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.399428631Z [2026-11-01T06:08:36,399][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.399430256Z [2026-11-01T06:08:36,399][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.399678339Z [2026-11-01T06:08:36,399][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.401461589Z [2026-11-01T06:08:36,401][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg] create_mapping
opensearch-1  | 2026-11-01T06:08:36.403622256Z [2026-11-01T06:08:36,403][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:36.411141089Z [2026-11-01T06:08:36,411][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index test-index from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.411156547Z [2026-11-01T06:08:36,411][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index test-index.
opensearch-1  | 2026-11-01T06:08:36.411157881Z [2026-11-01T06:08:36,411][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index test-index with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.411388756Z [2026-11-01T06:08:36,411][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[test-index/iDvM1kQlSmSIO03poiJRAQ]
opensearch-1  | 2026-11-01T06:08:36.412988089Z [2026-11-01T06:08:36,412][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.413000422Z [2026-11-01T06:08:36,412][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.413002047Z [2026-11-01T06:08:36,412][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.413206006Z [2026-11-01T06:08:36,413][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.421978797Z [2026-11-01T06:08:36,421][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.421991172Z [2026-11-01T06:08:36,421][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.421992256Z [2026-11-01T06:08:36,421][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.422880797Z [2026-11-01T06:08:36,422][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.590425881Z [2026-11-01T06:08:36,584][WARN ][o.o.s.a.BackendRegistry  ] [opensearch-node] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
opensearch-1  | 2026-11-01T06:08:36.591805589Z [2026-11-01T06:08:36,591][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.591842006Z [2026-11-01T06:08:36,591][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.591868756Z [2026-11-01T06:08:36,591][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.592203548Z [2026-11-01T06:08:36,592][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.594403048Z [2026-11-01T06:08:36,594][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:36.603710756Z [2026-11-01T06:08:36,603][WARN ][o.o.s.a.BackendRegistry  ] [opensearch-node] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
opensearch-1  | 2026-11-01T06:08:36.605381131Z [2026-11-01T06:08:36,605][WARN ][o.o.s.a.BackendRegistry  ] [opensearch-node] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
opensearch-1  | 2026-11-01T06:08:36.608179464Z [2026-11-01T06:08:36,608][WARN ][o.o.s.a.BackendRegistry  ] [opensearch-node] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
opensearch-1  | 2026-11-01T06:08:36.611698131Z [2026-11-01T06:08:36,611][WARN ][o.o.s.a.BackendRegistry  ] [opensearch-node] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
opensearch-1  | 2026-11-01T06:08:36.614188506Z [2026-11-01T06:08:36,614][WARN ][o.o.s.a.BackendRegistry  ] [opensearch-node] No 'Authorization' header, send 401 and 'WWW-Authenticate Basic'
opensearch-1  | 2026-11-01T06:08:36.627599381Z [2026-11-01T06:08:36,627][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.627642589Z [2026-11-01T06:08:36,627][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.627673464Z [2026-11-01T06:08:36,627][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.628136298Z [2026-11-01T06:08:36,628][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]
opensearch-1  | 2026-11-01T06:08:36.637171339Z [2026-11-01T06:08:36,637][INFO ][o.o.c.m.MetadataMappingService] [opensearch-node] [security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg] update_mapping [_doc]
opensearch-1  | 2026-11-01T06:08:36.665776214Z [2026-11-01T06:08:36,665][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating autoThrottle for index security-auditlog-2026.11.01 from [false] to [true]
opensearch-1  | 2026-11-01T06:08:36.665822756Z [2026-11-01T06:08:36,665][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Updating maxThreadCount from [0] to [1] and maxMergeCount from [0] to [6] for index security-auditlog-2026.11.01.
opensearch-1  | 2026-11-01T06:08:36.665847673Z [2026-11-01T06:08:36,665][INFO ][o.o.i.MergeSchedulerConfig] [opensearch-node] Initialized index security-auditlog-2026.11.01 with maxMergeCount=6, maxThreadCount=1, autoThrottleEnabled=true
opensearch-1  | 2026-11-01T06:08:36.666164048Z [2026-11-01T06:08:36,666][INFO ][o.o.p.PluginsService     ] [opensearch-node] PluginService:onIndexModule index:[security-auditlog-2026.11.01/Eklo5-lMR36xDVjXi_vefg]