Generated banner for Amazon Opensearch Service
Generated logo for Amazon Opensearch Service

Amazon Opensearch Service

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • Low risk

From the author

Guides migration, provisioning, search, log-analytics, trace-analytics, and Agentic AI Assistant workflows for Amazon OpenSearch Service and Serverless across six capabilities — migration (Solr/ES/self-managed into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, FGAC, monitoring); search (vector / semantic / hybrid / RAG with Bedrock); log-analytics (PPL, OSI, anomaly detection, Dashboards); trace-analytics (OTel spans, service maps, Data Prepper); ai-assistant (natural language data exploration, incident investigation, root cause analysis). Triggers on OpenSearch, AOS, AOSS, Elasticsearch, Solr, vector/k-NN/semantic/hybrid search, RAG, log analytics, PPL, trace analytics, ISM, FAISS, HNSW, Migration Assistant, UltraWarm, OR1, query my data, analyze logs, investigate errors, root cause analysis.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a unified framework for interacting with Amazon OpenSearch Service (AOS) and OpenSearch Serverless (AOSS). It covers the full lifecycle of OpenSearch operations, including migration from legacy systems like Solr or Elasticsearch, infrastructure provisioning, advanced search implementation (including vector and RAG), and observability through log and trace analytics. It also features an Agentic AI Assistant for natural language data exploration and incident investigation, ensuring users can navigate complex cluster management and data analysis tasks without manual query crafting.

What it does

  • Guides migration workflows from Solr, Elasticsearch, or self-managed OpenSearch to AOS/AOSS.
  • Assists with provisioning, lifecycle management, and monitoring of domains and collections.
  • Facilitates implementation of vector, semantic, and hybrid search, including RAG with Bedrock.
  • Supports log and trace analytics using PPL, OpenTelemetry, and anomaly detection.
  • Provides an Agentic AI Assistant for natural language querying and automated incident root cause analysis.
  • Enforces operational best practices for sharding, storage tiering, and security configurations.

When to use it

  • When planning a migration from legacy search engines to Amazon OpenSearch Service.
  • When setting up or optimizing search capabilities, including vector search and RAG.
  • When troubleshooting cluster health, performance, or shard allocation issues.
  • When performing log or trace analysis to investigate system incidents.
  • When you need to generate optimized PPL or DSL queries using natural language.

Advantages

  • Centralizes complex operational knowledge across six distinct OpenSearch capabilities.
  • Reduces manual query complexity by leveraging the Agentic AI Assistant.
  • Provides clear, actionable guidance on production failure modes and migration blockers.
  • Standardizes interactions through consistent CLI and data-plane patterns.
  • Promotes architectural best practices for scaling and cost-effective storage tiering.

Usage examples

“How do I migrate my existing Solr index to Amazon OpenSearch Service?”
The agent identifies the migration capability, explains that Solr to OpenSearch is a refactor migration, and guides you through using the Migration Assistant for data backfill.
“Why is my cluster status yellow and how can I fix it?”
The agent uses the AI Assistant capability to analyze cluster health, check shard allocation, and provide specific commands or steps to resolve unassigned shards.
“Help me set up a RAG pipeline using Bedrock and my OpenSearch domain.”
The agent routes to the search capability, providing instructions on configuring Bedrock connectors and vector index mappings for semantic retrieval.
“Find the root cause of the 503 errors in my application logs from the last hour.”
The agent utilizes the AI Assistant to query logs, perform time-series analysis, and correlate findings to identify the likely root cause of the errors.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/amazon-opensearch-service/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip amazon-opensearch-service.zip -d .agents/skills

Documentation by AWS

Amazon OpenSearch Service — the unified skill

This skill answers anything about Amazon OpenSearch Service or Serverless across six capabilities. Step 0 below routes the question to ONE capability and points at that capability's entry-point reference. Everything else — when to dispatch, sub-references, capability-specific facts, cross-capability links — lives in the entry-point reference for that capability.

AWS MCP server is recommended, not required. Capability references show standard AWS CLI commands as the primary syntax (e.g., aws opensearch describe-domain, aws opensearchserverless create-collection). Where the AWS MCP server is available, its call_aws tool offers a streamlined alternative — but every operation in this skill MUST work via the AWS CLI alone. Data-plane HTTP calls against AOS / AOSS use awscurl for SigV4-signed requests; this works in both contexts.

Step 0: detect the capability — first thing you do

Pick one of the six capabilities below. State the detected capability in your first sentence (e.g., "Detected capability: SEARCH — semantic search setup with Bedrock embeddings."). Then load the entry-point reference; that file describes when to dispatch, indexes the rest of the capability's files, and routes you to the next step.

CapabilityEntry-point reference
migration — Solr / Elasticsearch / self-managed OpenSearch into AOS or AOSS. Schema/query translation, sizing, cutover.references/assessment-workflow.md
provisioning — Provisioning and managing AOS domains and AOSS collections. Lifecycle, upgrades, storage tiers, FGAC, monitoring.references/provisioning-reference.md
search — Vector / semantic / hybrid / sparse / dense / RAG retrieval. Bedrock connectors, FAISS HNSW vs Lucene.references/search-semantic-search-guide.md
log-analytics — Log search, observability, PPL, OSI ingestion, anomaly detection, OpenSearch Dashboards. Splunk/Datadog/ELK alternatives.references/log-analytics-guide.md
trace-analytics — Distributed traces with OpenTelemetry. Span queries, service maps, Data Prepper.references/trace-analytics-trace-queries.md
ai-assistant — Agentic AI Assistant: auto-discovers indices, generates optimized PPL/DSL queries, summarizes results, and investigates incidents end-to-end. No manual query crafting needed.references/ai-assistant.md

If a prompt spans capabilities (e.g., "migrate from Solr AND set up RAG on the new domain"), pick the dominant capability for the response and close with a one-line handoff to the other capability's entry-point ref.

Universal rules (apply to ALL capabilities)

These rules apply to every response, regardless of capability. Capability-specific rules (sizing math, shape detection, Migration Assistant for Amazon OpenSearch Service capability matrix, k-NN engine selection) live in the entry-point references, not here.

  • Report header (every multi-section response). Begin every multi-section response with a single fenced metadata block: > Generated: <ISO 8601 timestamp> | Skill: amazon-opensearch-service v<N>. Get the time by calling the current_time tool (returns ISO 8601 in UTC). Read the skill version from this file's frontmatter version: field. For one-line answers (terse FOCUSED_OPERATIONAL replies, anti-pattern refusals) the header is optional; for any multi-section deliverable it is REQUIRED. Place it immediately after the report title and before the first ## heading.

  • No dollar estimates (HARD CONSTRAINT). Never produce $X/month, ~$1,500, or any dollar figure. Route every cost question to https://calculator.aws and stop. If a sub-reference contains dollar figures, treat them as informational context only and do NOT pass them through to the user.

  • No credential leakage (HARD CONSTRAINT). Never include master usernames, KMS key ARNs, VPC endpoint URLs, instance IPs, or account IDs in generated output.

  • Pick one for every A-vs-B decision. Name a primary recommendation in one line with a one-sentence reason. A "go with B if..." caveat is allowed AFTER the primary; never lead with conditional-only guidance.

  • Source restatement. The first 2–3 sentences must restate the source (engine + version + scale) when known, or restate the customer's question in concrete terms. The very first text the user sees must NOT be tool narration, meta-commentary, the report title, or simply restating the question verbatim.

  • No marketing tone. Do NOT use "seamless", "robust", "best-in-class", "production-hardened", "enterprise-grade", "world-class", "cleanly", "elegant". Do NOT stack 3+ vague hedges ("typically", "generally", "usually", "in most cases") in a single recommendation — be specific about when it does and does not apply.

  • Cross-capability handoff. When a user prompt spans capabilities (e.g., "migrate from Solr AND set up RAG on the new domain"), pick the dominant capability for the response, then close with a one-line handoff: "For <other capability>, see references/<other-capability>-<entry>.md."

Cross-cutting references (used across multiple capabilities)

These references are not capability-prefixed because they apply across capabilities. Capability entry-point references load them when relevant; SKILL.md never loads them directly.

Assets (assets/): report templates for FULL_ASSESSMENT renderings (Solr-source, ES-source, executive summary).

What this skill does NOT do

  • Estimate dollar costs. Pricing changes monthly and account-specific (RI, Savings Plan, EDP) discount math is outside this skill's reliable scope. Use https://calculator.aws.

  • Move data. Use Migration Assistant for Amazon OpenSearch Service (Historical Data Migration for backfill, Live Traffic Migration for live cutover).

  • Build embedding models. Use Amazon Bedrock or SageMaker.

  • Replace Splunk SPL or Datadog APM 1:1. Some queries / detectors / dashboards need rewriting.

  • Tune relevance for a specific catalog. Use OpenSearch Benchmark big5 workload + your own judgment list.

Guardrail — where this skill's own files live (MCP vs local install)

This skill can be loaded two ways, and they resolve the skill's own bundled files from different places. Determine how the skill was loaded before reading a reference or running a script:

  • Loaded through the AWS MCP server's retrieve_skill tool: The skill is not installed on the local filesystem. You MUST fetch each reference or script via retrieve_skill with the file parameter (e.g. file="references/architecture.md" or file="scripts/deploy.py"), and run the script from the returned content. Do NOT file_read these paths locally — they do not exist on disk.

  • Installed locally (e.g. .kiro/skills/your-skill/ or ~/.claude/skills/your-skill/): Read and run files from the local skill directory using relative paths.

This distinction applies only to the skill's own packaged files. User data and session artifacts are always read from and written to the user's working directory. Never fetch or write customer data through retrieve_skill.

Files

references/assessment-shape-comparative-decision.md


case_shape: COMPARATIVE_DECISION shape_family: decision one_liner: "User is choosing between two (or a small N of) concrete options and wants a pick, not an essay." when_to_dispatch: "Question contains 'A or B', 'should we use X vs Y', 'managed vs serverless', 'NextGen vs Classic', 'OR1 vs gp3', 'k-NN engine: faiss vs lucene vs nmslib', or any framing where the user has narrowed the universe to ~2-4 named alternatives and wants a recommendation." forbidden_sections:

  • "Timeline & Resourcing"

  • "Engineer-weeks estimate"

  • "Project plan / phases"

  • "Readiness scorecard (full)"

  • "Sizing math derivation (unless it IS the decision driver)"


Recipe: COMPARATIVE_DECISION

1. What this shape is

A comparative-decision response answers a binary or small-N choice with an explicit pick, a side-by-side table, and one load-bearing reason. It is the shortest of the decision shapes — the user is not asking for an assessment, a plan, or a tutorial. They have already reduced the search space and want a ruling.

Treat this as a one-screen artifact. The reader should be able to skim the pick, scan the table, and stop. Anyone who needs more depth will follow up.

2. Detection signals

Dispatch to this shape when the user prompt contains any of:

  • The literal token vs, versus, or, separating two named options ("Managed vs Serverless", "OR1 or gp3", "faiss vs lucene")

  • "Should we use ...", "Which is better for ...", "Pick one"

  • Two or three concrete AWS/OpenSearch SKU names (Domain, Serverless, NextGen, Classic, OR1, gp3, t3.small.search, faiss/lucene/nmslib, BM25 vs neural, hybrid vs pure-vector)

  • A request that names a specific workload bound (vector count, QPS, GB/day) and asks which option fits

  • Implicit comparisons: "do we even need Serverless for this?" — the second option is the user's current/default platform

Do not dispatch here when:

  • The user asks "what should we do?" with no named options → FULL_ASSESSMENT

  • The user asks "how do I migrate from X to Y?" → MIGRATION_PATH

  • The user asks "is X a good idea?" with one option only and red flags → ANTI_PATTERN_PUSHBACK

2.5 Over-constrained variant — the constraint trilemma

When the prompt names 3+ hard constraints (e.g., zero downtime, zero data loss, no third-party tooling, EU residency, fixed budget, fixed deadline) and asks "how do you reconcile these?" — the user is asking for a feasibility ruling, NOT a SKU pick. Before the Pick (§3.1), insert a Constraint feasibility block:

Feasibility: at <scale>, constraints {X, Y, Z} are mutually inconsistent without compromise. The path that satisfies any 2 of these forces a relaxation of the 3rd.

Then in §3.1 Pick, recommend the relaxation, not just the SKU:

Pick: relax <constraint> by <quantified trade-off> (e.g., "accept a 15-30 min read-only cutover window"), which converts the problem to <tractable shape> — then <tool/path> applies cleanly.

In the §3.2 comparison table, add a Relaxation column showing what each option costs you (which constraint it forces to bend). Decision driver (§3.3) names the conflict explicitly: "this option wins because it minimizes the relaxation needed on the load-bearing constraint."

Common conflict patterns to flag:

  • zero downtime + zero data loss + no third-party tooling at multi-TB scale — pick any two; the third forces a third-party CDC tool, an outage window, or accepted lag.

  • EU residency + global low-latency reads — pick one; cross-region replicas violate residency, in-region reads sacrifice latency outside EU.

  • fixed budget + fixed deadline + new compliance scope — pick two; new scope without budget or time relief is a red flag.

Dual-write reconciliation rule. If your pick proposes dual-write to the source and target during cutover, state plainly that application-layer dual-write written by the customer's own engineering team is customer code, NOT third-party tooling. Otherwise the response appears to violate a "no third-party tooling" constraint when it actually doesn't. Phrase: "Dual-write here is customer code in your existing services — it is not a third-party tool, agent, or vendor product."

Failure modes to avoid (tested against this rubric):

  • ❌ Claiming a single path "simultaneously satisfies" all 3+ constraints when it cannot — the rubric will fail you for not surfacing the conflict.

  • ❌ Picking a path that requires dual-write under a "no third-party tooling" constraint without the reconciliation rule above.

  • ❌ Treating the prompt as "which AWS SKU?" instead of "which constraint do we relax?" — these prompts are about trade-offs, not about Managed vs Serverless.

3. Required output template

Produce exactly these sections, in this order:

3.1 Pick (1-2 sentences)

Pick: <option>. <one-line load-bearing reason>. Caveat (only if needed): <single qualifier, e.g. "switch to <other> if <threshold>">.

The caveat goes after the pick, never before. No "it depends". No "both are valid". Pick one.

3.2 Comparison table

A markdown table with 4-7 rows. Columns are the options. Rows are the dimensions that actually moved the decision. Typical rows:

DimensionOption AOption B
Pricing model......
Min commit......
Max scale tested......
Vector engine support......
Operational burden......
Irreversible?......

Skip any dimension that is identical between options — it is not a decision driver.

3.3 Decision driver (1 sentence)

Name the single fact that pushed the pick. Example:

Decision driver: 100M vectors at 384 dims = ~150 GB raw, which exceeds the Serverless single-shard ceiling and forces sharded NextGen anyway.

3.4 Irreversibility callout (when applicable)

If the choice locks the customer in, say so plainly. Triggers:

  • NextGen vs Classic Serverless collection — chosen at create time, cannot be flipped

  • OR1 instance family — backed by S3, switching back to gp3-instance storage requires a new domain or blue/green

  • In-place engine upgrade — 2.x → 3.x cannot be rolled back without snapshot restore

  • Domain → Serverless — no in-place path, requires reindex/snapshot+restore

Format:

Irreversible: <what is locked>. To change later: <real path, e.g. "blue/green to a new domain">.

3.5 Inline doc URL

Exactly one AWS docs link, inline next to the most contested claim. Not a bibliography. Example:

...Serverless NextGen vector collections support up to 6 dimensions of filter pushdown (docs).

4. NOT REQUIRED — explicitly omit

Do NOT include any of the following in a comparative-decision response:

  • Timeline & Resourcing — removed from the suite, do not add it

  • Engineer-weeks, sprint count, "phase 1 / phase 2"

  • Full readiness scorecard (that is FULL_ASSESSMENT's job)

  • Sizing math derivation, unless the math IS the decision driver (then keep it to one line)

  • Customer-specific trade-offs ("if your team has Kotlin expertise...") — you do not know the team

  • Migration runbook / step-by-step ("first snapshot, then...")

  • Dollar cost projections of any kind (this is a HARD universal constraint — see SKILL.md). Direct cost questions to https://calculator.aws; comparative-decision tables MAY name relative cost SHAPES (e.g., "OCU floor vs sized-to-peak compute") but MUST NOT include dollar figures.

  • Risk register, mitigation plan, rollback playbook

  • Glossary, "what is OpenSearch" preamble

  • More than one doc URL

  • Bullet lists of "pros and cons" for each option separately — that is what the table is for

If you find yourself writing "Phase 1: Migration — 3 engineer-weeks", stop. Wrong shape.

5. Worked exemplar

Prompt: "We have 100M FAISS vectors at 384 dimensions, ~50 QPS read, mostly cosine similarity with a tenant_id filter. Should we use OpenSearch Serverless VECTORSEARCH NextGen or a managed Domain?"

Response:

Pick: OpenSearch Serverless VECTORSEARCH NextGen collection. At 100M / 384-dim with a single high-cardinality filter, NextGen's disk-optimized vector engine and per-OCU billing match the workload shape better than a provisioned Domain. Caveat: switch to a Domain with OR1 if you need sub-50 ms p99 with hybrid BM25+vector — Serverless tail latency is higher under mixed load.

DimensionServerless VECTORSEARCH NextGenManaged Domain (OR1)
Pricing modelPer-OCU, scale-to-floorPer-instance-hour, 24/7
Min spend (shape, not $)2 OCU search + 2 OCU index, 24/7 floor — plug into https://calculator.aws3x r6gd.large.search (instance-hour) — plug into https://calculator.aws
100M @ 384-dim feasible?Yes, NextGen disk-tier vector engineYes, but needs ~300 GB RAM hot
Filter pushdownUp to 6 fields, including high-cardinalityNative via k-NN plugin
Ops burdenZero shard tuningShard plan, JVM, snapshots
Engine lockNextGen vs Classic chosen at createOR1 family chosen at create
Irreversible?Yes — collection type fixedYes — instance family fixed

Decision driver: 100M vectors @ 384 dim ≈ 150 GB raw + graph overhead; Serverless NextGen's S3-backed vector engine reads this from disk without sizing a 300+ GB RAM Domain, and the tenant_id filter is exactly the high-cardinality case NextGen optimized for (docs).

Irreversible: NextGen vs Classic is set at collection-create and cannot be flipped. To change later: create a new collection and reindex.

That is the entire response. ~210 words including the table. No timeline, no phases, no readiness checklist.

6. Pre-emit checklist (shape-specific)

Before sending, tick every box:

  • [ ] Pick is explicit — one named option, in bold, in the first sentence

  • [ ] Caveat is after the pick (or absent) — never "it depends" before the pick

  • [ ] Comparison table has ≥4 rows and ≤7 rows — every row is a decision driver

  • [ ] No identical-value rows in the table (those are not deciders)

  • [ ] Decision driver named in one sentence, identifying the load-bearing fact

  • [ ] Irreversibility called out if the choice has a one-way door (NextGen-vs-Classic, OR1, in-place upgrade, Domain↔Serverless)

  • [ ] Exactly one inline doc URL, placed next to the most contested claim

  • [ ] Zero of the forbidden sections present (Timeline, engineer-weeks, readiness scorecard, full sizing derivation, migration runbook)

  • [ ] Total length under ~400 words (excluding the table)

  • [ ] No "pros/cons" bullet lists per option — the table replaces those

  • [ ] No glossary or preamble — go straight to the pick

  • [ ] If the prompt names ≥3 hard constraints (e.g., zero downtime + zero data loss + no third-party tooling + EU residency, or any 3+ from §2.5's trilemma list): the response MUST include the §2.5 Constraint feasibility block before the §3.1 Pick. The block names which constraints are mutually inconsistent, identifies which one is being relaxed, and quantifies the trade. Do not silently pick a path and present it as satisfying all constraints — the response will fail if it claims simultaneous satisfaction of an impossible set. If the pick involves dual-write, also tick the dual-write reconciliation rule (§2.5).

  • [ ] If the customer's source is NOT already on AOS (Solr, ES self-managed, OS self-managed, ES on EC2, etc.), the response MUST name the migration mechanism inline — Snapshot/Restore (pre-fork ES ≤ 7.10.2), Migration Assistant for Amazon OpenSearch Service Historical Data Migration, _reindex from remote, OSI, or in-place blue/green — and tie the choice to the source version where relevant (e.g., "7.10.2 is pre-fork, before the 7.11 ELv2 snapshot wall, so Snapshot/Restore is the path"). Do NOT punt with "see the migration capability" or "follow assessment-workflow.md" — the response is self-contained for the user.

  • [ ] If the source is ES with index lifecycle policies (ILM): call out the ILM → ISM rewrite explicitly. ILM JSON does NOT port to OpenSearch (gotcha #29). Either name "ILM-to-ISM rewrite" as a migration step or include a one-line ISM policy phrase showing the rewrite is acknowledged.

  • [ ] If recommending an in-place upgrade: name the mechanism blue/green explicitly. Do NOT invent a per-minor-version chain (e.g., 2.5 → 2.7 → 2.9 → 2.11 → 2.19). AOS supports multi-version blue/green jumps within 2.x and within 3.x; the only mandatory waypoint is 2.19 when crossing into 3.x (and 1.3 for sources < 1.3). State the actual hops, not a fake chain.

If any box is unticked, fix it before emitting. If you cannot tick "Pick is explicit" because the answer genuinely depends on a missing fact, ask one clarifying question instead of producing a hedged comparison.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/amazon-opensearch-service · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
aws/agent-toolkit-for-aws

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download amazon-opensearch-service.zip