Agentic Search - Error when searcing

[Hashim-Khawaja]

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.3

Describe the issue: Trying to run an agentic search - getting hit with this issue:

Error searching index: Data Source Error: [illegal_argument_exception] Agentic search failed - Agent execution error - Agent ID: [kNVHZ5sBytpwlteB9eel], Error: [[14010a993d7beb40da458f1f45f3f355][x.x.x.x:9300][cluster:admin/opensearch/ml/execute]]

Configuration:

• Using claude bedrock model
• fine grained access controlled disabled on my domain
• Have an IAM w/ Bedrock

Relevant Logs or Screenshots:

[pablo]

@Hashim-Khawaja I’ve tested that with Query Planning tool only using Bedrock Claude Model.
At first, I’ve got very similar error as yours and I’ve found that my API key was invalid.
The invalid key error was in OpenSearch logs.

opensearch-node2_3.3.0       | [2025-12-30T16:39:45,244][ERROR][o.o.m.e.a.a.MLAgentExecutor] [opensearch-node2] Failed to run conversational agent
opensearch-node2_3.3.0       | org.opensearch.OpenSearchStatusException: Error from remote service: {"message":"The security token included in the request is invalid."}
opensearch-node2_3.3.0       |  at org.opensearch.ml.engine.algorithms.remote.MLSdkAsyncHttpResponseHandler.response(MLSdkAsyncHttpResponseHandler.java:188) [opensearch-ml-algorithms-3.3.0.0.jar:?]
opensearch-node2_3.3.0       |  at org.opensearch.ml.engine.algorithms.remote.MLSdkAsyncHttpResponseHandler$MLResponseSubscriber.onComplete(MLSdkAsyncHttpResponseHandler.java:167) [opensearch-ml-algorithms-3.3.0.0.jar:?]

Once I’ve created a new API key and recreated a Bedrock Claude connector with a new key, the test completed successfully.

This is my agent

{
  "name": "Agentic Search with Claude 4",
  "type": "flow",
  "description": "A test agent for query planning.",
  "tools": [
    {
      "description": "A general tool to answer any question",
      "include_output_in_agent_response": false,
      "type": "QueryPlanningTool",
      "parameters": {
        "search_templates": "[{\"template_id\":\"flower_species_search_template\",\"template_description\":\"This template searches for flowers that match the given species using a match query.\"},{\"template_id\":\"flower_petal_length_range_template\",\"template_description\":\"This template searches for flowers within a specific petal length range using a range query.\"}]",
        "response_filter": "$.output.message.content[0].text",
        "model_id": "<model_id>",
        "generation_type": "user_templates"
      }
    }
  ]
}

This is my Bedrock Claude connector

POST /_plugins/_ml/models/_register?deploy=true
{
  "name": "Claude 4 sonnet Query Planner tool Model",
  "function_name": "remote",
  "description": "Claude 4 sonnet for Query Planning",
  "connector": {
    "name": "Bedrock Claude 4 Sonnet Connector",
    "description": "Amazon Bedrock connector for Claude 4 Sonnet",
    "version": 1,
    "protocol": "aws_sigv4",
    "parameters": {
      "region": "us-east-1",
      "service_name": "bedrock",
      "model": "us.anthropic.claude-sonnet-4-20250514-v1:0"
    },
    "credential": {
      "access_key": "<access_key>",
      "secret_key": "<secret_key>"
    },
    "actions": [
      {
        "action_type": "predict",
        "method": "POST",
        "url": "https://bedrock-runtime.${parameters.region}.amazonaws.com/model/${parameters.model}/converse",
        "headers": {
          "content-type": "application/json"
        },
        "request_body": "{ \"system\": [{\"text\": \"${parameters.system_prompt}\"}], \"messages\": [${parameters._chat_history:-}{\"role\":\"user\",\"content\":[{\"text\":\"${parameters.user_prompt}\"}]}${parameters._interactions:-}]${parameters.tool_configs:-} }"
      }
    ]
  }
}

Test query output

[ohltyler]

@Hashim-Khawaja were you able to resolve? Typically, when the error is coming from the underlying execution, it indicates some issue with the model, permissions or otherwise. A few things you can try:

1. Similar to @pablo comment, check the logs for errors on the execution. This should point you to next steps.
2. Direct execution of the model via predict API. If this fails, it confirms some issue with the model talking to the remote endpoint.

If you’re still running into issues, can you share the model and connector configurations? Note that for Claude models, you can refer to the documentation for model setup: Configuring agents - OpenSearch Documentation

If it’s permissions issues, you can refer to the IAM role documentation: Amazon OpenSearch Service ML connectors for third-party platforms - Amazon OpenSearch Service

There is also now a CloudFormation template that handles all of the model provisioning in AWS for you, using Claude. If you’re interested, you can read that documentation here: Configuring Agentic Search with Bedrock Claude - Amazon OpenSearch Service