Generated banner for Amazon Opensearch Service
Generated logo for Amazon Opensearch Service

Amazon Opensearch Service

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • Low risk

From the author

Guides migration, provisioning, search, log-analytics, trace-analytics, and Agentic AI Assistant workflows for Amazon OpenSearch Service and Serverless across six capabilities — migration (Solr/ES/self-managed into AOS/AOSS, schema/query translation, sizing, cutover); provisioning (domain + AOSS lifecycle, upgrades, FGAC, monitoring); search (vector / semantic / hybrid / RAG with Bedrock); log-analytics (PPL, OSI, anomaly detection, Dashboards); trace-analytics (OTel spans, service maps, Data Prepper); ai-assistant (natural language data exploration, incident investigation, root cause analysis). Triggers on OpenSearch, AOS, AOSS, Elasticsearch, Solr, vector/k-NN/semantic/hybrid search, RAG, log analytics, PPL, trace analytics, ISM, FAISS, HNSW, Migration Assistant, UltraWarm, OR1, query my data, analyze logs, investigate errors, root cause analysis.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a unified framework for interacting with Amazon OpenSearch Service (AOS) and OpenSearch Serverless (AOSS). It covers the full lifecycle of OpenSearch operations, including migration from legacy systems like Solr or Elasticsearch, infrastructure provisioning, advanced search implementation (including vector and RAG), and observability through log and trace analytics. It also features an Agentic AI Assistant for natural language data exploration and incident investigation, ensuring users can navigate complex cluster management and data analysis tasks without manual query crafting.

What it does

  • Guides migration workflows from Solr, Elasticsearch, or self-managed OpenSearch to AOS/AOSS.
  • Assists with provisioning, lifecycle management, and monitoring of domains and collections.
  • Facilitates implementation of vector, semantic, and hybrid search, including RAG with Bedrock.
  • Supports log and trace analytics using PPL, OpenTelemetry, and anomaly detection.
  • Provides an Agentic AI Assistant for natural language querying and automated incident root cause analysis.
  • Enforces operational best practices for sharding, storage tiering, and security configurations.

When to use it

  • When planning a migration from legacy search engines to Amazon OpenSearch Service.
  • When setting up or optimizing search capabilities, including vector search and RAG.
  • When troubleshooting cluster health, performance, or shard allocation issues.
  • When performing log or trace analysis to investigate system incidents.
  • When you need to generate optimized PPL or DSL queries using natural language.

Advantages

  • Centralizes complex operational knowledge across six distinct OpenSearch capabilities.
  • Reduces manual query complexity by leveraging the Agentic AI Assistant.
  • Provides clear, actionable guidance on production failure modes and migration blockers.
  • Standardizes interactions through consistent CLI and data-plane patterns.
  • Promotes architectural best practices for scaling and cost-effective storage tiering.

Usage examples

“How do I migrate my existing Solr index to Amazon OpenSearch Service?”
The agent identifies the migration capability, explains that Solr to OpenSearch is a refactor migration, and guides you through using the Migration Assistant for data backfill.
“Why is my cluster status yellow and how can I fix it?”
The agent uses the AI Assistant capability to analyze cluster health, check shard allocation, and provide specific commands or steps to resolve unassigned shards.
“Help me set up a RAG pipeline using Bedrock and my OpenSearch domain.”
The agent routes to the search capability, providing instructions on configuring Bedrock connectors and vector index mappings for semantic retrieval.
“Find the root cause of the 503 errors in my application logs from the last hour.”
The agent utilizes the AI Assistant to query logs, perform time-series analysis, and correlate findings to identify the likely root cause of the errors.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/amazon-opensearch-service/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip amazon-opensearch-service.zip -d .agents/skills

Documentation by AWS

Amazon OpenSearch Service — the unified skill

This skill answers anything about Amazon OpenSearch Service or Serverless across six capabilities. Step 0 below routes the question to ONE capability and points at that capability's entry-point reference. Everything else — when to dispatch, sub-references, capability-specific facts, cross-capability links — lives in the entry-point reference for that capability.

AWS MCP server is recommended, not required. Capability references show standard AWS CLI commands as the primary syntax (e.g., aws opensearch describe-domain, aws opensearchserverless create-collection). Where the AWS MCP server is available, its call_aws tool offers a streamlined alternative — but every operation in this skill MUST work via the AWS CLI alone. Data-plane HTTP calls against AOS / AOSS use awscurl for SigV4-signed requests; this works in both contexts.

Step 0: detect the capability — first thing you do

Pick one of the six capabilities below. State the detected capability in your first sentence (e.g., "Detected capability: SEARCH — semantic search setup with Bedrock embeddings."). Then load the entry-point reference; that file describes when to dispatch, indexes the rest of the capability's files, and routes you to the next step.

CapabilityEntry-point reference
migration — Solr / Elasticsearch / self-managed OpenSearch into AOS or AOSS. Schema/query translation, sizing, cutover.references/assessment-workflow.md
provisioning — Provisioning and managing AOS domains and AOSS collections. Lifecycle, upgrades, storage tiers, FGAC, monitoring.references/provisioning-reference.md
search — Vector / semantic / hybrid / sparse / dense / RAG retrieval. Bedrock connectors, FAISS HNSW vs Lucene.references/search-semantic-search-guide.md
log-analytics — Log search, observability, PPL, OSI ingestion, anomaly detection, OpenSearch Dashboards. Splunk/Datadog/ELK alternatives.references/log-analytics-guide.md
trace-analytics — Distributed traces with OpenTelemetry. Span queries, service maps, Data Prepper.references/trace-analytics-trace-queries.md
ai-assistant — Agentic AI Assistant: auto-discovers indices, generates optimized PPL/DSL queries, summarizes results, and investigates incidents end-to-end. No manual query crafting needed.references/ai-assistant.md

If a prompt spans capabilities (e.g., "migrate from Solr AND set up RAG on the new domain"), pick the dominant capability for the response and close with a one-line handoff to the other capability's entry-point ref.

Universal rules (apply to ALL capabilities)

These rules apply to every response, regardless of capability. Capability-specific rules (sizing math, shape detection, Migration Assistant for Amazon OpenSearch Service capability matrix, k-NN engine selection) live in the entry-point references, not here.

  • Report header (every multi-section response). Begin every multi-section response with a single fenced metadata block: > Generated: <ISO 8601 timestamp> | Skill: amazon-opensearch-service v<N>. Get the time by calling the current_time tool (returns ISO 8601 in UTC). Read the skill version from this file's frontmatter version: field. For one-line answers (terse FOCUSED_OPERATIONAL replies, anti-pattern refusals) the header is optional; for any multi-section deliverable it is REQUIRED. Place it immediately after the report title and before the first ## heading.

  • No dollar estimates (HARD CONSTRAINT). Never produce $X/month, ~$1,500, or any dollar figure. Route every cost question to https://calculator.aws and stop. If a sub-reference contains dollar figures, treat them as informational context only and do NOT pass them through to the user.

  • No credential leakage (HARD CONSTRAINT). Never include master usernames, KMS key ARNs, VPC endpoint URLs, instance IPs, or account IDs in generated output.

  • Pick one for every A-vs-B decision. Name a primary recommendation in one line with a one-sentence reason. A "go with B if..." caveat is allowed AFTER the primary; never lead with conditional-only guidance.

  • Source restatement. The first 2–3 sentences must restate the source (engine + version + scale) when known, or restate the customer's question in concrete terms. The very first text the user sees must NOT be tool narration, meta-commentary, the report title, or simply restating the question verbatim.

  • No marketing tone. Do NOT use "seamless", "robust", "best-in-class", "production-hardened", "enterprise-grade", "world-class", "cleanly", "elegant". Do NOT stack 3+ vague hedges ("typically", "generally", "usually", "in most cases") in a single recommendation — be specific about when it does and does not apply.

  • Cross-capability handoff. When a user prompt spans capabilities (e.g., "migrate from Solr AND set up RAG on the new domain"), pick the dominant capability for the response, then close with a one-line handoff: "For <other capability>, see references/<other-capability>-<entry>.md."

Cross-cutting references (used across multiple capabilities)

These references are not capability-prefixed because they apply across capabilities. Capability entry-point references load them when relevant; SKILL.md never loads them directly.

Assets (assets/): report templates for FULL_ASSESSMENT renderings (Solr-source, ES-source, executive summary).

What this skill does NOT do

  • Estimate dollar costs. Pricing changes monthly and account-specific (RI, Savings Plan, EDP) discount math is outside this skill's reliable scope. Use https://calculator.aws.

  • Move data. Use Migration Assistant for Amazon OpenSearch Service (Historical Data Migration for backfill, Live Traffic Migration for live cutover).

  • Build embedding models. Use Amazon Bedrock or SageMaker.

  • Replace Splunk SPL or Datadog APM 1:1. Some queries / detectors / dashboards need rewriting.

  • Tune relevance for a specific catalog. Use OpenSearch Benchmark big5 workload + your own judgment list.

Guardrail — where this skill's own files live (MCP vs local install)

This skill can be loaded two ways, and they resolve the skill's own bundled files from different places. Determine how the skill was loaded before reading a reference or running a script:

  • Loaded through the AWS MCP server's retrieve_skill tool: The skill is not installed on the local filesystem. You MUST fetch each reference or script via retrieve_skill with the file parameter (e.g. file="references/architecture.md" or file="scripts/deploy.py"), and run the script from the returned content. Do NOT file_read these paths locally — they do not exist on disk.

  • Installed locally (e.g. .kiro/skills/your-skill/ or ~/.claude/skills/your-skill/): Read and run files from the local skill directory using relative paths.

This distinction applies only to the skill's own packaged files. User data and session artifacts are always read from and written to the user's working directory. Never fetch or write customer data through retrieve_skill.

Files

references/assessment-shape-translation.md

Shape recipe: TRANSLATION_TASK

What this shape is

The user has a working query, request body, or DSL fragment in another search engine (Solr, Elasticsearch ≥ 7.11 syntax that needs OS-side adjustments, raw Lucene syntax, or vendor-specific dialect) and wants the OpenSearch equivalent. The deliverable is drop-in JSON or code that the user can paste into _search, _msearch, a client SDK call, or an OpenSearch Dashboards Dev Tools tab.

This shape is purely a syntactic + semantic mapping exercise. It is NOT a migration assessment, NOT a sizing exercise, and NOT a relevance-tuning engagement.

When to dispatch here

Detect TRANSLATION_TASK when the user prompt contains any of:

  • "translate this Solr query"

  • "convert this DSL"

  • "what's the OpenSearch equivalent of …"

  • "rewrite this for OpenSearch"

  • "this is my Solr q=…&fq=…&qf=…, give me OpenSearch JSON"

  • A pasted Solr URL query string (/select?q=…&qf=…&pf=…&mm=…&tie=…)

  • A pasted ES query that uses post-fork-only features (e.g. runtime_mappings in 7.12+, ES 8.x knn top-level field) and the user is targeting AOS managed

  • A pasted Lucene q= string with field-prefix syntax (title:headphones AND brand:sony)

Do NOT dispatch here when:

  • The user pasted schema.xml or an ES mapping → that's SCHEMA_CONVERSION.

  • The user wants migration tooling guidance ("how do I move my Solr docs to OS") → that's FULL_ASSESSMENT or FOCUSED_OPERATIONAL.

  • The user asks "how do I write a query that does X" with no source DSL → that's a search-recipe lookup; serve from references/search-recipes.md directly.

Required output template

Produce these sections in order, nothing more:

1. Source restatement (1 sentence)

"Translating Solr 8.11 eDisMax q=wireless headphones&qf=title^3 description&pf=title^5&mm=2<-25%&q.op=AND&tie=0.3 to OpenSearch 2.x _search."

State source engine + version (if known) + the specific query type (eDisMax, dismax, standard, function query, JSON Facet API, …) + target endpoint.

2. Drop-in JSON / code (the deliverable)

A single fenced code block, valid JSON, ready to paste into Dev Tools. Preserve field names exactly. Include query, from/size, sort, aggs, highlight blocks as the source request had them.

3. Translation fidelity table

For every non-trivial Solr/ES parameter in the source, one row showing source param → OpenSearch param → fidelity (verbatim / mapped / approximation). This is the heart of the shape — every syntactic element must be either preserved or explicitly mapped, with no silent drops.

4. Approximation caveats (inline, only if any rows in the table are "approximation")

A short bullet list of behavior drift the user must be aware of. Examples:

  • pf (phrase boost): modeled as a should clause with multi_match type: phrase. Scoring shape differs — Solr's pf boosts the whole phrase score additively; OpenSearch's should adds a separately-scored phrase match. Re-tune boost values against your judgment list.

  • tie_breaker default: OpenSearch multi_match best_fields defaults tie_breaker: 0.0 (winner-takes-all); Solr eDisMax defaults tie=0.0 as well, but if the source omitted tie, set it explicitly to avoid surprises if you later upgrade.

  • q.op=AND: OpenSearch query_string defaults to OR. Set default_operator: AND explicitly or results will diverge.

5. Verification snippet (optional, 1–3 lines)

If the translation is non-trivial, give the user a 1-line _validate/query?explain=true or a 2-doc sanity check they can run to confirm the rewrite parses and scores reasonably.

NOT REQUIRED — explicitly OMIT

Do NOT produce these sections in TRANSLATION_TASK:

  • Timeline & Resourcing — removed from the suite. Do NOT estimate engineer-weeks, sprint count, or calendar duration anywhere.

  • Executive Summary — translation is tactical, not a deliverable that needs an exec frame.

  • Source / Target / Migration Path / Risks — the four big assessment sections; not applicable here.

  • Sizing / Readiness scorecard — translation has no infra footprint.

  • Citations section — only include if you make ≥3 version-volatile claims (e.g. "this only works in OS 2.13+"). For a normal Solr→OS query rewrite, citations are noise.

  • Migration tooling discussion — do NOT pivot to "and to move your data, use Migration Assistant for Amazon OpenSearch Service…". Stay in the lane.

  • Dollar costs — universal hard constraint; never produce a dollar figure.

  • Persona-aware framing — the asker self-selected by pasting DSL; treat them as a search engineer.

Solr → OpenSearch query translation reference table

This is the canonical lookup. Use it; do NOT re-derive per request.

Solr (or ES 7.x dialect)OpenSearchFidelityNotes
q=headphones{"multi_match": {"query": "headphones", "fields": ["title", "description"]}}mappedSolr searches df (default field); OS has no _all — name fields explicitly.
q=title:headphones{"match": {"title": "headphones"}}verbatimField-scoped match.
q.op=AND"default_operator": "AND" (on query_string) or "operator": "AND" (on match / multi_match)verbatimOpenSearch defaults to OR. #1 cause of result divergence. Always set explicitly.
defType=edismaxmulti_match type: best_fieldsmappedClosest semantic equivalent; not byte-identical scoring.
qf=title^3 description^1 tags^2"fields": ["title^3", "description^1", "tags^2"]verbatimBoosts pass through unchanged.
pf=title^5 (phrase boost)should: [{"multi_match": {"query": "<q>", "type": "phrase", "fields": ["title^5"]}}]approximationScoring shape differs — see caveats.
pf2=title^3 / pf3=title^2Two should clauses with match_phrase and slop adjustmentapproximationSolr's bigram/trigram phrase boost has no exact OS equivalent.
tie=0.3"tie_breaker": 0.3 (on multi_match best_fields)verbatimSame semantics.
mm=2<-25%"minimum_should_match": "2<-25%"verbatimSyntax passes UNCHANGED — same parser.
mm=100%"minimum_should_match": "100%"verbatimAll clauses must match.
fq=in_stock:truebool.filter: [{"term": {"in_stock": true}}]verbatimFilter context — no scoring, cacheable.
bq=category:electronics^2 (boost query)should: [{"term": {"category": {"value": "electronics", "boost": 2}}}]verbatimAdditive scoring boost.
bf=recip(ms(NOW,timestamp),3.16e-11,1,1) (boost function)function_score with gauss or exp decay on timestampmappedSolr recip is a hyperbolic decay; OS gauss/exp give equivalent shape — re-tune scale.
sort=score desc, price asc"sort": [{"_score": "desc"}, {"price": "asc"}]verbatimscore → _score.
start=20&rows=20"from": 20, "size": 20verbatim
fl=title,price,_score"_source": ["title", "price"] (_score always returned)verbatim
hl=true&hl.fl=title"highlight": {"fields": {"title": {}}}verbatim
facet=true&facet.field=category"aggs": {"by_category": {"terms": {"field": "category.keyword"}}}mappedUse .keyword sub-field for terms agg.
facet.range=price&facet.range.start=0&facet.range.end=100&facet.range.gap=20"aggs": {"price_ranges": {"range": {"field": "price", "ranges": [{"to":20},{"from":20,"to":40},…]}}}mappedOS uses explicit range buckets.
mlt=truemore_like_this querymappedSame semantics, different request shape.
wt=json(default) Accept: application/jsonverbatimOS speaks JSON natively.
group=true&group.field=brand"collapse": {"field": "brand.keyword"}mappedOS collapse ≈ Solr field collapsing for top-1 per group.
cursorMark=*search_after + tiebreaker sortmappedOS deep pagination via PIT + search_after.

Worked exemplar

User: Translate this Solr query: q=wireless headphones&defType=edismax&qf=title^3 description^1 tags^2&pf=title^5&mm=2<-25%&q.op=AND&tie=0.3&fq=in_stock:true&start=0&rows=20&sort=score desc, price asc&hl=true&hl.fl=title

Assistant response (this is the shape):

Translating Solr 8.x eDisMax q=wireless headphones (qf/pf/mm/tie/q.op/fq/sort/highlight) to OpenSearch 2.x _search.

GET products/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "multi_match": {
            "query": "wireless headphones",
            "type": "best_fields",
            "fields": ["title^3", "description^1", "tags^2"],
            "operator": "AND",
            "minimum_should_match": "2<-25%",
            "tie_breaker": 0.3
          }
        }
      ],
      "should": [
        {
          "multi_match": {
            "query": "wireless headphones",
            "type": "phrase",
            "fields": ["title^5"]
          }
        }
      ],
      "filter": [
        {"term": {"in_stock": true}}
      ]
    }
  },
  "from": 0,
  "size": 20,
  "sort": [{"_score": "desc"}, {"price": "asc"}],
  "highlight": {"fields": {"title": {}}}
}
Solr paramOpenSearchFidelity
defType=edismaxmulti_match type: best_fieldsmapped
qf=title^3 description^1 tags^2fields: ["title^3","description^1","tags^2"]verbatim
pf=title^5should + multi_match type: phraseapproximation
mm=2<-25%minimum_should_match: "2<-25%"verbatim
q.op=ANDoperator: "AND"verbatim
tie=0.3tie_breaker: 0.3verbatim
fq=in_stock:truefilter term clauseverbatim
sort=score desc, price ascsort: [{"_score":"desc"},{"price":"asc"}]verbatim
hl=true&hl.fl=titlehighlight.fields.titleverbatim

Approximation caveats:

  • pf phrase boost: modeled as a separate should clause; Solr eDisMax adds the pf score to the eDisMax sum, OpenSearch adds the should score to the bool sum. Top-N order should be similar but not identical — re-tune pf boost (using the example value ^5) against your judgment list.

  • q.op=AND: set as operator: "AND" on multi_match (cleaner than query_string for this case). OpenSearch defaults to OR — without this, recall would explode.

To sanity-check parsing: POST products/_validate/query?explain=true with the same body — confirms the BoolQuery / DisjunctionMaxQuery structure matches expectation.

Pre-emit checklist (TRANSLATION_TASK-specific)

Before sending the response, tick every box:

  • [ ] First sentence is the source restatement (engine + version + query type + target endpoint), not tool narration.

  • [ ] Output contains a single, valid, copy-pasteable JSON block for _search (or the right endpoint).

  • [ ] Every parameter from the source request is either present in the OS JSON or explicitly mapped in the fidelity table — no silent drops.

  • [ ] q.op / default_operator is handled explicitly: if the source had AND (Solr q.op=AND OR an explicit AND/&& boolean operator inside a Lucene query_string query), it MUST appear in the JSON itself — operator: "AND" on match/multi_match, or default_operator: "AND" on query_string. Discussing it only in prose or in the approximation caveats does NOT satisfy this rule (the customer is told to drop the JSON in directly, so the JSON has to be correct on its own). Apply this to every query in a multi-query translation, not only the first.

  • [ ] mm / minimum_should_match preserved verbatim (same parser; do not "simplify" 2<-25%).

  • [ ] eDisMax qf boosts preserved verbatim in multi_match.fields.

  • [ ] Any pf / pf2 / pf3 is in a separate should clause AND flagged in caveats as approximation.

  • [ ] tie_breaker is set explicitly when the source had tie (do not rely on defaults).

  • [ ] Field names that need .keyword sub-field for term / terms agg / sort are using it.

  • [ ] NO Timeline & Resourcing section. NO Executive Summary. NO Sizing. NO migration tooling pivot.

  • [ ] NO dollar figures anywhere.

  • [ ] No marketing tone ("seamless", "robust", "best-in-class", "elegant", "cleanly").

  • [ ] Citations section omitted unless ≥3 version-volatile claims were made.

  • [ ] If approximation rows exist, the caveats bullet list is present — never leave approximation unflagged.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/amazon-opensearch-service · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
aws/agent-toolkit-for-aws

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download amazon-opensearch-service.zip