Skip to main content

OpenSearch

Overview​

OpenSearch digunakan sebagai storage dan search engine untuk logs, alerts, dan audit trail.

Configuration​

Docker Compose​

opensearch:
  image: opensearchproject/opensearch:3.7.0
  container_name: opensearch
  environment:
    - cluster.name=opensearch-cluster
    - node.name=opensearch-node1
    - discovery.type=single-node
    - OPENSEARCH_INITIAL_ADMIN_PASSWORD=MyStrong@OpenSearch2026!
    - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g
    - bootstrap.memory_lock=true
  ulimits:
    memlock:
      soft: -1
      hard: -1
  ports:
    - "9200:9200"
    - "9600:9600"
  volumes:
    - opensearch-data:/usr/share/opensearch/data
  mem_limit: 2g
  cpus: "1.00"

Index Templates​

logs-*​

{
  "index_patterns": ["logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "message": { "type": "text" },
        "level": { "type": "keyword" },
        "source_type": { "type": "keyword" },
        "app_slug": { "type": "keyword" },
        "tenant_id": { "type": "keyword" }
      }
    }
  }
}

wazuh-alerts-*​

{
  "index_patterns": ["wazuh-alerts-*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "alert_id": { "type": "keyword" },
        "rule_id": { "type": "keyword" },
        "rule_description": { "type": "text" },
        "rule_level": { "type": "integer" },
        "alert_status": { "type": "keyword" },
        "agent_id": { "type": "keyword" },
        "agent_name": { "type": "keyword" },
        "full_log": { "type": "text" }
      }
    }
  }
}

audit-log-*​

{
  "index_patterns": ["audit-log-*"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "actor": { "type": "keyword" },
        "action": { "type": "keyword" },
        "target": { "type": "keyword" },
        "result": { "type": "keyword" },
        "ip": { "type": "keyword" },
        "details": { "type": "object" }
      }
    }
  }
}

dashboard-services​

{
  "index_patterns": ["dashboard-services"],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    },
    "mappings": {
      "properties": {
        "source.system_name": { "type": "keyword" },
        "source.service": { "type": "keyword" },
        "source.status": { "type": "keyword" },
        "source.uptime_percent": { "type": "float" },
        "source.request_count": { "type": "long" },
        "source.avg_latency_ms": { "type": "float" },
        "source.error_rate_percent": { "type": "float" },
        "source.log_count": { "type": "long" }
      }
    }
  }
}

Aliases​

Tenant Isolation​

# Create tenant-specific alias
curl -X PUT "https://localhost:9200/_aliases" -H 'Content-Type: application/json' -d'
{
  "actions": [
    {
      "add": {
        "index": "clm-v2-logs-*",
        "alias": "clm-bjb-syariah",
        "filter": {
          "term": {
            "tenant_id.keyword": "bjb-syariah"
          }
        }
      }
    }
  ]
}
'

Common Operations​

Check Cluster Health​

curl -sk -u admin:MyStrong@OpenSearch2026! \
  https://localhost:9200/_cluster/health?pretty

List Indices​

curl -sk -u admin:MyStrong@OpenSearch2026! \
  https://localhost:9200/_cat/indices?v

Search Logs​

curl -sk -u admin:MyStrong@OpenSearch2026! \
  https://localhost:9200/logs-*/_search \
  -H 'Content-Type: application/json' \
  -d '{
    "query": {
      "bool": {
        "must": [
          { "match": { "message": "error" } }
        ],
        "filter": [
          { "range": { "@timestamp": { "gte": "now-24h" } } }
        ]
      }
    },
    "size": 10
  }'

Delete Old Indices​

# Delete indices older than 30 days
curl -sk -u admin:MyStrong@OpenSearch2026! \
  https://localhost:9200/logs-2026.05.*/_delete_by_query \
  -H 'Content-Type: application/json' \
  -d '{"query": {"match_all": {}}}'

Monitoring​

Cluster Stats​

curl -sk -u admin:MyStrong@OpenSearch2026! \
  https://localhost:9200/_cluster/stats?pretty

Node Stats​

curl -sk -u admin:MyStrong@OpenSearch2026! \
  https://localhost:9200/_nodes/stats?pretty

Next Steps​