Cloud Parts

OpenSearch

The Apache 2.0 fork of Elasticsearch and Kibana 7.10.2 that AWS started in 2021, now run by a Linux Foundation project.

What it is
Search indexes
Used for
Logs,Observability
Type
Open source
Made by
OpenSearch Software Foundation
License
Apache 2.0
Facts checked
6 October 2026
Website Source code

What it is

OpenSearch works the way Elasticsearch 7.10 did, because that is where it came from. It stores JSON documents in indices, splits each index into shards that are each an Apache Lucene index, keeps replica shards on other nodes, and answers the same REST APIs and query syntax that 7.10 had. A rolling upgrade from Elasticsearch 7.0 to 7.10 works node by node, and indices created in Elasticsearch 6.0 to 7.10 can be read directly. OpenSearch Dashboards is the matching fork of Kibana. Everything in the project, including security with document- and field-level access control, alerting and anomaly detection, is free under Apache 2.0, and contributors don’t sign a licence agreement.

The two have drifted apart since 2021, so newer Elasticsearch indices (8.x and later) can’t be moved over without reindexing. OpenSearch added segment replication, where replicas copy finished Lucene segments from the primary or from remote-backed object storage instead of re-indexing every document; vector search through a knn_vector field backed by the Faiss, Lucene or NMSLIB libraries; PPL, a piped query language for logs; and Data Prepper, its own ingest service. Version 3.0 (May 2025) moved to Lucene 10 and Java 21 and added experimental gRPC transport and pull-based ingestion from Kafka and Kinesis.

AWS created OpenSearch and still runs it as Amazon OpenSearch Service, as managed clusters or a serverless option; the same service keeps legacy Elasticsearch versions up to 7.10. In September 2024 AWS moved the project to the OpenSearch Software Foundation under the Linux Foundation, launched with AWS, SAP and Uber as premier members.

Why teams pick it

  • Open source under Apache 2.0 with no contributor licence agreement, and neutral governance at the Linux Foundation since 2024
  • Security, alerting, anomaly detection, SQL and PPL come in the free distribution
  • A straightforward way off Elasticsearch 7.x: rolling upgrades from 7.0 to 7.10, and the same REST APIs
  • Fully managed on AWS as Amazon OpenSearch Service, including a serverless option

Watch out for

  • Not a drop-in for current Elasticsearch: indices from after 7.10 must be reindexed, and features such as ES|QL exist only on the Elastic side
  • Logstash and Beats weren’t forked: you pick versions from OpenSearch’s compatibility matrix, or use Data Prepper or another shipper
  • It inherits Elasticsearch’s operational work: choosing shard counts up front, sizing nodes, and writes that become searchable only after a refresh
  • Some newer features (gRPC transport, pull-based ingestion) were still experimental in 3.0

Alternatives

What all search indexes have in common →
ElasticsearchCommercialThe distributed search and analytics engine built on Apache Lucene: JSON documents in, full-text, vector and log queries out, over a REST API.pg_trgmOpen sourceA PostgreSQL extension that splits text into three-letter pieces, so `LIKE '%foo%'`, regex and typo-tolerant searches can use an index.UrsaDBOpen sourceCERT Polska’s byte-trigram index for malware collections: it narrows a YARA hunt over terabytes of files down to a few candidates.

How it fits with other technologies

Create a vector index and find the nearest neighbours · bash

OS=https://localhost:9200; AUTH="admin:$OPENSEARCH_INITIAL_ADMIN_PASSWORD"

curl -k -u $AUTH -X PUT $OS/docs -H 'Content-Type: application/json' -d '{
  "settings": { "index": { "knn": true } },
  "mappings": { "properties": { "embedding": {
    "type": "knn_vector", "dimension": 3, "space_type": "l2",
    "method": { "name": "hnsw", "engine": "faiss" } } } }
}'

curl -k -u $AUTH -X POST "$OS/docs/_doc?refresh=true" -H 'Content-Type: application/json' \
  -d '{"title": "gaskets", "embedding": [0.1, 0.2, 0.3]}'

curl -k -u $AUTH "$OS/docs/_search" -H 'Content-Type: application/json' -d '{
  "size": 2, "query": { "knn": { "embedding": { "vector": [0.1, 0.2, 0.25], "k": 2 } } }
}'

See it in a real stack

No architecture uses OpenSearch yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2019–2025

AWS sold Elasticsearch as a managed service, Amazon Elasticsearch Service, and in 2019 it launched Open Distro for Elasticsearch, which added security, alerting and other features to Elastic’s Apache 2.0 builds. On January 21, 2021, Elastic said that after 7.10.2 new versions of Elasticsearch and Kibana would no longer be released under Apache 2.0, but under the Elastic License with source code under the Elastic License or SSPL, mainly to stop cloud providers from offering them as a service. The same day AWS announced it would create and maintain an Apache 2.0 fork.

On April 12, 2021, AWS introduced the OpenSearch project: OpenSearch, derived from Elasticsearch 7.10.2, and OpenSearch Dashboards, derived from Kibana 7.10.2, with Open Distro’s features folded in. Version 1.0 shipped in July 2021, and in September Amazon Elasticsearch Service was renamed Amazon OpenSearch Service.

For its first three years the project was hosted by AWS. In September 2024 AWS transferred it to the new OpenSearch Software Foundation at the Linux Foundation, which reported more than 700 million downloads and over 200 maintainers. Version 3.0 followed in May 2025, the first major release since 2.0 in 2022.

Why it’s built this way

Fork the last Apache 2.0 release
AWS wanted a version it could keep offering as a service and that users could run with the freedoms of Apache 2.0, so it forked 7.10.2, the last release before the licence change.
Stay compatible with Elasticsearch 7.10
Keeping the REST APIs, query syntax and index format let existing clusters move over with a rolling upgrade, and let existing clients and tools keep working.
Paid-style features in the free core
Open Distro had already built security, alerting, SQL and index management for AWS’s service. Folding them into the default Apache 2.0 distribution made them part of the open-source project instead of add-ons.
No contributor licence agreement, then a foundation
AWS said that skipping a CLA makes it easy for anyone to contribute. It also means no single company collects the rights it would need to relicense the code, the move that caused the fork. Moving the project to the Linux Foundation in 2024 took ownership away from AWS as well.

Timeline

  1. 2019

    AWS launches Open Distro for Elasticsearch

  2. 2021

    Elastic leaves Apache 2.0 in January; OpenSearch introduced in April, 1.0 in July

  3. 2021

    Amazon Elasticsearch Service becomes Amazon OpenSearch Service in September

  4. 2022

    OpenSearch 2.0 released

  5. 2024

    OpenSearch Software Foundation launched at the Linux Foundation in September

  6. 2025

    OpenSearch 3.0 moves to Lucene 10 and Java 21 in May

Sources17 · facts checked 6 October 2026

Improve this page on GitHub