# Plugins **URL:** https://forum.opensearch.org/c/plugins/52.md [Latest](https://forum.opensearch.org/latest.md) · [Categories](https://forum.opensearch.org/categories.md) · [Tags](https://forum.opensearch.org/tags.md) --- ## [About the Plugins category](https://forum.opensearch.org/t/about-the-plugins-category/4846)
**Author:** [@kris](https://forum.opensearch.org/u/kris)\ **Replies:** 0\ **Last updated:** [February 3, 2021, 6:55pm UTC](https://forum.opensearch.org/t/about-the-plugins-category/4846 "2021-02-03T18:55:23Z")
Discussion area for OpenSearch and OpenSearch Dashboards plugins. Please post new topics in the appropriate sub-category. --- ## [How Can We Prevent AI Data Leakage?](https://forum.opensearch.org/t/how-can-we-prevent-ai-data-leakage/28307)
**Author:** [@rom\_c](https://forum.opensearch.org/u/rom_c)\ **Replies:** 0\ **Last updated:** [September 30, 2026, 3:57pm UTC](https://forum.opensearch.org/t/how-can-we-prevent-ai-data-leakage/28307 "2026-09-30T15:57:31Z")
AI tools are becoming part of everyday business workflows, but they can also create new data security concerns. Employees may accidentally share sensitive information such as customer details, credentials, internal docum… --- ## [CCR and Snapshot](https://forum.opensearch.org/t/ccr-and-snapshot/28267)
**Author:** [@farman](https://forum.opensearch.org/u/farman)\ **Replies:** 1\ **Last updated:** [September 24, 2026, 1:35pm UTC](https://forum.opensearch.org/t/ccr-and-snapshot/28267 "2026-09-24T13:35:17Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: If CCR is configured between Leader and Follower clusters, when snapshot of Follower is taken will it also include replication specific m… --- ## [How to handle pre-existing indices using Auto-Follow](https://forum.opensearch.org/t/how-to-handle-pre-existing-indices-using-auto-follow/28289)
**Author:** [@farman](https://forum.opensearch.org/u/farman)\ **Replies:** 3\ **Last updated:** [September 24, 2026, 10:11am UTC](https://forum.opensearch.org/t/how-to-handle-pre-existing-indices-using-auto-follow/28289 "2026-09-24T10:11:14Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: If I am using Auto-Follow for replication, then, follower indices are created automatically based on “pattern” and “follower\_index\_patter… --- ## ["follower\_index\_pattern" missing in CCR Auto-follow documentation](https://forum.opensearch.org/t/follower-index-pattern-missing-in-ccr-auto-follow-documentation/28284)
**Author:** [@farman](https://forum.opensearch.org/u/farman)\ **Replies:** 3\ **Last updated:** [September 23, 2026, 2:12pm UTC](https://forum.opensearch.org/t/follower-index-pattern-missing-in-ccr-auto-follow-documentation/28284 "2026-09-23T14:12:37Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: “follower\_index\_pattern” has been introduced in OpenSearch 3.8.0 as per release notes opensearch-build/release-notes/opensearch-release-n… --- ## [Teknofest finalist – SIEM log integrity project, looking for feedback](https://forum.opensearch.org/t/teknofest-finalist-siem-log-integrity-project-looking-for-feedback/28293)
**Author:** [@feridmehdiyevpersona](https://forum.opensearch.org/u/feridmehdiyevpersona)\ **Replies:** 2\ **Last updated:** [September 22, 2026, 8:29am UTC](https://forum.opensearch.org/t/teknofest-finalist-siem-log-integrity-project-looking-for-feedback/28293 "2026-09-22T08:29:04Z")
Hello everyone, I’m a cybersecurity engineering student at BHOS, and my team is currently in the final stage of the TEKNOFEST Blockchain Competition. Our project focuses on SIEM log integrity. We have built a working p… --- ## [Help configuring an OpenSearch 3.5 alerting monitor with three triggers](https://forum.opensearch.org/t/help-configuring-an-opensearch-3-5-alerting-monitor-with-three-triggers/28261)
**Author:** [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Replies:** 3\ **Last updated:** [September 4, 2026, 4:06pm UTC](https://forum.opensearch.org/t/help-configuring-an-opensearch-3-5-alerting-monitor-with-three-triggers/28261 "2026-09-04T16:06:28Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.5/OSD 3.5/Win10/Google Chrome Describe the issue: I am using OpenSearch 3.5 and need assistance configuring an Alerting Monitor. I need to cre… --- ## [CIDR modifier for sigma detection rules works only for IPv4 addresses, not for IPv6 resulting in sigma detection error](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232)
**Author:** [@mutant](https://forum.opensearch.org/u/mutant)\ **Replies:** 5\ **Last updated:** [August 25, 2026, 9:22am UTC](https://forum.opensearch.org/t/cidr-modifier-for-sigma-detection-rules-works-only-for-ipv4-addresses-not-for-ipv6-resulting-in-sigma-detection-error/28232 "2026-08-25T09:22:12Z")
I was getting a Sigma Detection Error when trying to import a rule from Sigma repository to opensearch. Upon further inspection in the source code, i found out that only IPv4 addresses are validated. IPv6 addresses fail … --- ## [OpenSearch Observability Forum](https://forum.opensearch.org/t/opensearch-observability-forum/28221)
**Author:** [@Amitjain0142](https://forum.opensearch.org/u/Amitjain0142)\ **Replies:** 1\ **Last updated:** [July 27, 2026, 9:30am UTC](https://forum.opensearch.org/t/opensearch-observability-forum/28221 "2026-07-27T09:30:36Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue:Hi Team, We are monitoring the OpenSearch Kubernetes Operator using Prometheus. The operator exposes Go runtime metrics and controller-r… --- ## [How to get Alerting permissions to create monitors on an internal Atlas OpenSearch cluster?](https://forum.opensearch.org/t/how-to-get-alerting-permissions-to-create-monitors-on-an-internal-atlas-opensearch-cluster/28180)
**Author:** [@cecflore](https://forum.opensearch.org/u/cecflore)\ **Replies:** 3\ **Last updated:** [July 10, 2026, 11:03am UTC](https://forum.opensearch.org/t/how-to-get-alerting-permissions-to-create-monitors-on-an-internal-atlas-opensearch-cluster/28180 "2026-07-10T11:03:14Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch Dashboards Describe the issue: I’m trying to create an Alert Monitor on our internal Atlas OpenSearch cluster to send pick short notifications to … --- ## [Issue with Sending Test Messages in OpenSearch Alerting](https://forum.opensearch.org/t/issue-with-sending-test-messages-in-opensearch-alerting/28170)
**Author:** [@Douaa\_MIKOU](https://forum.opensearch.org/u/Douaa_MIKOU)\ **Replies:** 1\ **Last updated:** [June 30, 2026, 12:04pm UTC](https://forum.opensearch.org/t/issue-with-sending-test-messages-in-opensearch-alerting/28170 "2026-06-30T12:04:26Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: I’m encountering an issue while trying to send a test message from OpenSearch to a Microsoft Teams channel. I have set up an alerting not… --- ## [CCR bootstrap of large clusters](https://forum.opensearch.org/t/ccr-bootstrap-of-large-clusters/28148)
**Author:** [@gchakkalakkal1](https://forum.opensearch.org/u/gchakkalakkal1)\ **Replies:** 1\ **Last updated:** [June 24, 2026, 11:06am UTC](https://forum.opensearch.org/t/ccr-bootstrap-of-large-clusters/28148 "2026-06-24T11:06:39Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.2 Describe the issue:CCR bootstrap starts successfully and begins transferring shard segment files from the leader to the follower cluster. For some larg… --- ## [Cross-Cluster Replication: Creating index pattern in standby cluster triggers un-killable, long-running search queries on primary cluster (indices\[\*\])](https://forum.opensearch.org/t/cross-cluster-replication-creating-index-pattern-in-standby-cluster-triggers-un-killable-long-running-search-queries-on-primary-cluster-indices/28138)
**Author:** [@vnovotny98](https://forum.opensearch.org/u/vnovotny98)\ **Replies:** 13\ **Last updated:** [June 22, 2026, 1:55pm UTC](https://forum.opensearch.org/t/cross-cluster-replication-creating-index-pattern-in-standby-cluster-triggers-un-killable-long-running-search-queries-on-primary-cluster-indices/28138 "2026-06-22T13:55:42Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser) 2.19.3 Describe the issue: Hello community, I am experiencing a severe performance issue where creating a new index pattern in our standby/backup OpenSearc… --- ## [CCR role reversal](https://forum.opensearch.org/t/ccr-role-reversal/28144)
**Author:** [@gchakkalakkal1](https://forum.opensearch.org/u/gchakkalakkal1)\ **Replies:** 0\ **Last updated:** [June 21, 2026, 1:35pm UTC](https://forum.opensearch.org/t/ccr-role-reversal/28144 "2026-06-21T13:35:22Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.2 Describe the issue: CCR: persist leader-\>follower checkpoint metadata to avoid full re-sync on role change. When a cluster that was previously a CCR lea… --- ## [ISM Policy Update Not Reflected on Older Managed Indices After Replica Count Change](https://forum.opensearch.org/t/ism-policy-update-not-reflected-on-older-managed-indices-after-replica-count-change/28115)
**Author:** [@Jijo.john](https://forum.opensearch.org/u/Jijo.john)\ **Replies:** 4\ **Last updated:** [June 14, 2026, 2:41pm UTC](https://forum.opensearch.org/t/ism-policy-update-not-reflected-on-older-managed-indices-after-replica-count-change/28115 "2026-06-14T14:41:58Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6.0 Describe the issue: I have an Index State Management (ISM) policy that manages index lifecycle across Hot, Snapshot, Warm, and Delete states. Origina… --- ## [Help create a detector](https://forum.opensearch.org/t/help-create-a-detector/28083)
**Author:** [@Kin0sh](https://forum.opensearch.org/u/Kin0sh)\ **Replies:** 15\ **Last updated:** [June 8, 2026, 8:06am UTC](https://forum.opensearch.org/t/help-create-a-detector/28083 "2026-06-08T08:06:22Z")
Hi. I have an OpenSearch cluster with two nodes, a hot and a warm. An attempt to create a detector fails with a “timeout” error. Looking at the GET \_cluster/allocation/explain command, we see the following response. The… --- ## [Having problems with ISM policies not being applied to the backing indices of datastreams](https://forum.opensearch.org/t/having-problems-with-ism-policies-not-being-applied-to-the-backing-indices-of-datastreams/28091)
**Author:** [@CRRemacle](https://forum.opensearch.org/u/CRRemacle)\ **Replies:** 1\ **Last updated:** [May 28, 2026, 8:53am UTC](https://forum.opensearch.org/t/having-problems-with-ism-policies-not-being-applied-to-the-backing-indices-of-datastreams/28091 "2026-05-28T08:53:46Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 2.19 Describe the issue: When an ISM policy exists and associated with a datastream index template, the newly created backing indices are not be… --- ## [Channels Visibility across all tenants](https://forum.opensearch.org/t/channels-visibility-across-all-tenants/28077)
**Author:** [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Replies:** 5\ **Last updated:** [May 19, 2026, 11:40am UTC](https://forum.opensearch.org/t/channels-visibility-across-all-tenants/28077 "2026-05-19T11:40:11Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6 Describe the issue: We have added this setting in the opensearch.yml file to filter out the alerts or monitors created by tenant. Now we are running in… --- ## [Index Patterns - for Monitoring](https://forum.opensearch.org/t/index-patterns-for-monitoring/28037)
**Author:** [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Replies:** 2\ **Last updated:** [May 1, 2026, 8:59pm UTC](https://forum.opensearch.org/t/index-patterns-for-monitoring/28037 "2026-05-01T20:59:18Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6 - Google Chrome Describe the issue: Does the index pattern (including data stream) automatically populate or does the user need to specify the pattern m… --- ## [Unable to deploy local custom model - No Controller is deployed](https://forum.opensearch.org/t/unable-to-deploy-local-custom-model-no-controller-is-deployed/28025)
**Author:** [@pythagoras](https://forum.opensearch.org/u/pythagoras)\ **Replies:** 9\ **Last updated:** [April 23, 2026, 11:22am UTC](https://forum.opensearch.org/t/unable-to-deploy-local-custom-model-no-controller-is-deployed/28025 "2026-04-23T11:22:57Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Version 3.6 Describe the issue: I cannot not deploy a local pretrained or local custom model. I am running an OpenSeach Cluster with 3 Nodes inside K8s Clus… --- ## [Issue Creating Detectors – Timeout and Continuous Index Creation/Deletion (Security Analytics)](https://forum.opensearch.org/t/issue-creating-detectors-timeout-and-continuous-index-creation-deletion-security-analytics/28008)
**Author:** [@loi](https://forum.opensearch.org/u/loi)\ **Replies:** 4\ **Last updated:** [April 22, 2026, 10:41am UTC](https://forum.opensearch.org/t/issue-creating-detectors-timeout-and-continuous-index-creation-deletion-security-analytics/28008 "2026-04-22T10:41:47Z")
Dear Support Team, We are currently experiencing an issue with the Security Analytics feature in our OpenSearch cluster. Specifically, we are unable to create new detectors. Every attempt to create a detector results in… --- ## [CVE-2026-33870/1 High Vulnerabilities in netty](https://forum.opensearch.org/t/cve-2026-33870-1-high-vulnerabilities-in-netty/27991)
**Author:** [@NeilBillett](https://forum.opensearch.org/u/NeilBillett)\ **Replies:** 4\ **Last updated:** [April 21, 2026, 12:13pm UTC](https://forum.opensearch.org/t/cve-2026-33870-1-high-vulnerabilities-in-netty/27991 "2026-04-21T12:13:35Z")
Hi - are there any plans/mitigations for these two recent high severity vulnerabilities for netty: They are vulnerabilities in \< netty 4.1.132.Final around DoS and request smuggling. I see in the recent 2.19.5 rele… --- ## [I get an error when trying to create a detection rule](https://forum.opensearch.org/t/i-get-an-error-when-trying-to-create-a-detection-rule/27860)
**Author:** [@Ruslan1](https://forum.opensearch.org/u/Ruslan1)\ **Replies:** 2\ **Last updated:** [April 3, 2026, 7:21pm UTC](https://forum.opensearch.org/t/i-get-an-error-when-trying-to-create-a-detection-rule/27860 "2026-04-03T19:21:27Z")
I have data sent by auditbeat version 8.15.5. They enter the datastream with the following settings: { ".ds-logs-auditbeat-8.5.0-000001": { "settings": { "index": { "replication": { "type":… --- ## [Findings were not creating for valid documents](https://forum.opensearch.org/t/findings-were-not-creating-for-valid-documents/27962)
**Author:** [@Aravinth](https://forum.opensearch.org/u/Aravinth)\ **Replies:** 2\ **Last updated:** [April 1, 2026, 11:28am UTC](https://forum.opensearch.org/t/findings-were-not-creating-for-valid-documents/27962 "2026-04-01T11:28:33Z")
In my cluster i have few detector and suddenly some detectors stopped working. when checking that i can see some errors in cluster level. \[2026-04-01T08:36:51,975\]\[DEBUG\]\[o.o.a.s.TransportSearchAction\]\[1baf01041046fd159… --- ## [Support of CCR for migration to a new Opensearch version](https://forum.opensearch.org/t/support-of-ccr-for-migration-to-a-new-opensearch-version/27939)
**Author:** [@farman](https://forum.opensearch.org/u/farman)\ **Replies:** 7\ **Last updated:** [March 31, 2026, 10:50am UTC](https://forum.opensearch.org/t/support-of-ccr-for-migration-to-a-new-opensearch-version/27939 "2026-03-31T10:50:43Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.11 and above Describe the issue: Can CCR be used to migrate data from older version of OpenSearch to a new one using Blue Green Deployment ? If so, then ho… --- ## [Registered agent using gemini returns API key not valid](https://forum.opensearch.org/t/registered-agent-using-gemini-returns-api-key-not-valid/27957)
**Author:** [@gstorme](https://forum.opensearch.org/u/gstorme)\ **Replies:** 2\ **Last updated:** [March 30, 2026, 9:02pm UTC](https://forum.opensearch.org/t/registered-agent-using-gemini-returns-api-key-not-valid/27957 "2026-03-30T21:02:43Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.5.0 Describe the issue: Following the documentation on Register agent - OpenSearch Documentation I have registered an agent: POST /\_plugins/\_ml/agents/\_r… --- ## [Migration Assistant without AWS Services](https://forum.opensearch.org/t/migration-assistant-without-aws-services/27952)
**Author:** [@farman](https://forum.opensearch.org/u/farman)\ **Replies:** 2\ **Last updated:** [March 27, 2026, 6:32am UTC](https://forum.opensearch.org/t/migration-assistant-without-aws-services/27952 "2026-03-27T06:32:04Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: Is it possible to use OpenSearch Migration Assistant to upgrade to a new version of OpenSearch without using AWS services. The Migration … --- ## [How to create semantic search agent using flow type](https://forum.opensearch.org/t/how-to-create-semantic-search-agent-using-flow-type/27888)
**Author:** [@YukiS](https://forum.opensearch.org/u/YukiS)\ **Replies:** 1\ **Last updated:** [March 23, 2026, 11:14pm UTC](https://forum.opensearch.org/t/how-to-create-semantic-search-agent-using-flow-type/27888 "2026-03-23T23:14:54Z")
The agent created below is a conversational type agent. If there is a way to create a flow type agent capable of both keyword search and semantic search, please let me know. --- ## [Convert\_index\_to\_remote issue with datastreams](https://forum.opensearch.org/t/convert-index-to-remote-issue-with-datastreams/27929)
**Author:** [@zuuz94](https://forum.opensearch.org/u/zuuz94)\ **Replies:** 3\ **Last updated:** [March 18, 2026, 12:00pm UTC](https://forum.opensearch.org/t/convert-index-to-remote-issue-with-datastreams/27929 "2026-03-18T12:00:17Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.5 Describe the issue: I have ISM policy that creates searchable snapshot. Flow: index fill up with data → rollover → snapshot action → convert\_… --- ## [Index Management supporting transform job as there action](https://forum.opensearch.org/t/index-management-supporting-transform-job-as-there-action/27927)
**Author:** [@gourabh09](https://forum.opensearch.org/u/gourabh09)\ **Replies:** 2\ **Last updated:** [March 16, 2026, 1:50pm UTC](https://forum.opensearch.org/t/index-management-supporting-transform-job-as-there-action/27927 "2026-03-16T13:50:58Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: Our goal is to make a transform job that runs just one day before the deletion of index . currently working solution is the we can put le… [Next page](https://forum.opensearch.org/c/plugins/52.md?page=1)