If you’ve worked with logs, search, or AI applications on AWS, you’ve run into Amazon OpenSearch Service sooner or later. It’s the managed engine behind everything from e-commerce search bars to security dashboards to the retrieval layer of RAG chatbots. And 2026 has been a big year for it — a new log analytics engine, a rebuilt serverless architecture, and a version release built around agentic AI.

At Electromech, we work with Amazon OpenSearch Service regularly as part of our AWS practice, and we train Linux and cloud professionals who end up running or tuning it in production. So instead of just listing features, this guide walks through what the service actually does, what changed recently, and what any of it means if you’re the one deciding how to architect around it.

Not sure if your current OpenSearch setup still makes sense? Book a free 20-minute call with our AWS team →

What Is Amazon OpenSearch Service?

Amazon OpenSearch Service is a fully managed version of OpenSearch, the open-source search and analytics engine that grew out of Elasticsearch and now lives under the Linux Foundation. Instead of provisioning your own cluster, patching nodes, and handling failover by hand, AWS runs the infrastructure for you while you focus on indexes, queries, and dashboards.

The service covers three overlapping jobs:

• Search — full-text and keyword search for websites, catalogs, and internal tools.
• Log analytics and observability — ingesting and querying application logs, traces, and metrics at scale.
• Vector and AI search — storing embeddings for semantic search, recommendations, and retrieval-augmented generation (RAG).

You can run Amazon OpenSearch Service two ways. Managed domains give you dedicated instances, storage tiers, and full control over sizing. OpenSearch Serverless removes capacity planning entirely and scales automatically based on demand. Both share the same underlying engine, security model, and query APIs, so the choice mostly comes down to how predictable your workload is.

Core Capabilities of Amazon OpenSearch Service

Full-Text and Lexical Search

At its core, Amazon OpenSearch Service is still a search engine. It indexes documents, tokenizes text, and ranks results using algorithms like BM25 — the same lexical search approach that’s powered search boxes for years. This is the backbone of website search, product catalogs, and any use case where users type in exact terms and expect fast, relevant matches.

Vector Search for AI and RAG Applications

Amazon OpenSearch Service doubles as a vector database. It converts text, images, or audio into high-dimensional embeddings and searches them using approximate nearest-neighbor algorithms such as HNSW. This underpins semantic search, recommendation engines, and RAG pipelines that connect large language models to your own data. It also supports hybrid search, which blends keyword scoring with vector similarity in a single query so you get the precision of exact matches alongside the context-awareness of semantic search.

For teams scaling vector workloads, GPU-accelerated k-NN indexing (generally available since early 2026) lets you build billion-scale vector indexes in under an hour, at a fraction of the cost of CPU-only indexing. Native integrations with Amazon Bedrock and zero-ETL pipelines from Amazon DynamoDB and Amazon DocumentDB mean you can add vector search on top of existing operational data without building custom pipelines.

Log Analytics and Observability

This is where a huge share of Amazon OpenSearch Service workloads live: application logs, infrastructure metrics, traces, and security events, all searchable in near real time through OpenSearch Dashboards. Teams use it for troubleshooting, SIEM-style security analytics, and compliance reporting, often ingesting terabytes of log data per day.

Alerting and Cluster Management

Beyond search and analytics, Amazon OpenSearch Service includes built-in monitoring, alerting, and fine-grained access control. You can trigger notifications through Slack, Amazon SNS, or custom webhooks when metrics cross a threshold, and manage data lifecycle across hot, UltraWarm, and cold storage tiers to control cost as data ages.

What’s New in Amazon OpenSearch Service: 2026 Updates

This is the part worth paying attention to if you already run OpenSearch workloads on AWS. Several announcements this year change the cost and performance math significantly.

A Purpose-Built Log Analytics Engine

The biggest recent announcement is a new optimized engine mode built specifically for log analytics, detailed in AWS’s benchmark post. Rather than storing everything through Lucene’s inverted index alone, the optimized engine writes data in Apache Parquet columnar format and uses Apache Calcite to route each query to whichever execution engine handles it best — Apache DataFusion for analytical aggregations, Lucene for search predicates. Both hand off mid-query, so a single request can aggregate millions of log lines and then pull a specific document, without extra round trips.

AWS’s own billion-document benchmarks are worth noting:

• Up to 4x better price-performance versus the general-purpose engine
• Roughly 2x faster ingestion, sustaining 1.78 million documents per second in testing
• Up to 70% lower storage, since the columnar format eliminates per-document JSON overhead
• Aggregation queries that were taking seconds dropped to well under a second in several benchmark patterns, with one “log volume by host” query running 70x faster

The trade-off: at launch, the optimized engine is a domain-level setting you choose when creating a new domain — you can’t retrofit it onto an existing one, and the DSL query API isn’t supported yet (PPL and SQL are). If you’re standing up a new observability domain, though, it’s hard to justify not testing it against your workload.

The Next Generation of OpenSearch Serverless

OpenSearch Serverless got a ground-up rearchitecture, now generally available, aimed squarely at agentic AI and bursty workloads. The headline change is full decoupling of compute and storage through a new shared storage layer, which enables genuine scale-to-zero: when a collection sits idle for 10 minutes, compute drops to zero, and capacity comes back in about 10 seconds when traffic resumes. AWS reports up to 20x faster autoscaling and up to 60% lower cost compared to provisioning for peak load.

This new “NextGen” architecture also ships with native integrations for agent-building platforms, including Vercel and Kiro, plus OpenSearch Agent Skills that bring OpenSearch capabilities directly into coding tools like Claude Code and Cursor. Existing serverless collections are now called “Classic,” and NextGen is the default for new collections in the console.

OpenSearch 3.5: Built for Agentic AI

Amazon OpenSearch Service now supports OpenSearch 3.5, and the release leans heavily into agent-building. Persistent conversation memory lets agents retain context and tool-reasoning across multi-turn conversations. A context management layer automatically truncates and summarizes what gets sent to an LLM, which helps control token costs without losing response quality. There’s also a redesigned no-code agent builder with Model Context Protocol (MCP) support, so teams can assemble agents using search templates and conversational memory without writing custom orchestration code.

Operational and Infrastructure Improvements

A handful of smaller but genuinely useful updates rounded out the year:

• Expanded Cluster Insights, now covering all OpenSearch versions and Elasticsearch 6.8+, including a new “Unused Index” insight that flags indices with zero activity in 30 days and recommends moving them to warm or cold storage.
• Cluster Overload and Suboptimal Sharding Strategy insights, which surface resource bottlenecks and shard imbalances before they cause throttling.
• Capacity Optimized blue/green deployments, which no longer require 100% spare instance capacity upfront — updates now roll out in incremental batches, useful for large clusters where doubling capacity temporarily isn’t realistic.
• New instance types, including Graviton4-based i8ge storage-optimized instances (up to 60% better compute performance than previous-generation Im4gn) and expanded regional availability for OR2/OM2 optimized instances.

Amazon OpenSearch Service Pricing

Pricing depends on which deployment model you choose. Managed domains bill for the instance types and storage you provision, on-demand or through reserved instances, plus optional UltraWarm and cold storage tiers for aging data. OpenSearch Serverless bills based on OpenSearch Compute Units (OCUs) for indexing and search, plus storage, with the new NextGen architecture allowing usage to drop to zero during idle periods. Notably, the new optimized log analytics engine runs at standard OpenSearch Service rates — there’s no additional premium for using it. For current numbers, always check the official Amazon OpenSearch Service pricing page, since instance and storage rates vary by region.

Want a second opinion on your OpenSearch cost or architecture? Grab a slot on our AWS team’s calendar →

Common Use Cases for Amazon OpenSearch Service

• Application and infrastructure log analytics — centralized troubleshooting and observability dashboards
• Security analytics and SIEM — correlating events and alerting on suspicious activity
• Website and e-commerce search — fast, typo-tolerant product and content search
• RAG and generative AI applications — grounding LLM responses in your own data through vector and hybrid search
• Fraud detection and anomaly detection — pattern matching across large, fast-moving datasets
• Recommendation engines — semantic similarity search across catalogs or content libraries

Getting Started with Amazon OpenSearch Service

1. Pick a deployment model. Choose a managed domain if you need predictable sizing and full control, or OpenSearch Serverless if your traffic is spiky or you’d rather not manage capacity at all.
2. Choose your use case in the console. For log-heavy workloads, select the Observability use case at domain creation to enable the optimized log analytics engine by default.
3. Set up ingestion. Use the same Bulk API and client libraries your pipelines already use — no rework required to adopt the newer engine options.
4. Configure security and access. Fine-grained access control, VPC placement, and encryption should be set up before you start sending production data.
5. Build dashboards and alerts. OpenSearch Dashboards and the alerting plugin cover most observability and search-monitoring needs out of the box.

Why This Matters for Cloud and DevOps Professionals

Amazon OpenSearch Service sits at the intersection of the skills we teach most at Electromech Academy — Linux administration, AWS architecture, and increasingly, the observability and AI tooling that modern DevOps and platform engineering roles expect. Whether you’re coming through our AWS certification tracks or our RHCSA and RHCE programs, understanding how a managed search and log analytics platform fits into a broader cloud architecture is quickly becoming a baseline expectation, not a specialty skill.

Looking to upskill your team on AWS or Red Hat fundamentals? Talk to our training team →

Frequently Asked Questions

What is Amazon OpenSearch Service used for? It’s used for full-text search, log analytics and observability, security analytics, and vector search for AI and RAG applications — often several of these at once on the same domain.

Is Amazon OpenSearch Service the same as Elasticsearch? No. Amazon OpenSearch Service is AWS’s managed offering built on OpenSearch, the open-source fork that emerged after Elasticsearch changed its licensing. It supports Elasticsearch OSS versions up to 7.10 as well as all current OpenSearch versions.

What is OpenSearch Serverless? It’s an auto-scaling deployment option for Amazon OpenSearch Service that removes cluster sizing and capacity planning. The next-generation architecture, now generally available, adds true scale-to-zero and decoupled compute and storage.

Is Amazon OpenSearch Service open source? The underlying OpenSearch project is open source under the Apache 2.0 license and governed under the Linux Foundation. Amazon OpenSearch Service is the fully managed AWS version of that engine.

How much does Amazon OpenSearch Service cost? Costs depend on instance types, storage tiers, and whether you use managed domains or Serverless. There’s no extra charge for the new optimized log analytics engine — it runs at standard rates. Check AWS’s pricing page for current regional rates.