I hope I missed nothing.
opensearch.yml
cluster.name: docker-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
# # minimum_master_nodes need to be explicitly set when bound on a public IP
# # set to 1 to allow single node clusters
# discovery.zen.minimum_master_nodes: 1
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# discovery.type: single-node
opensearch.experimental.feature.telemetry.enabled: true
telemetry.feature.metrics.enabled: true
telemetry.feature.tracer.enabled: true
telemetry.tracer.enabled: true
######## Start OpenSearch Security Demo Configuration ########
# WARNING: revise all the lines below before you go into production
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn: ['CN=kirk,OU=client,O=client,L=test,C=de']
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [all_access, security_rest_api_access]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [.plugins-ml-agent, .plugins-ml-config, .plugins-ml-connector,
.plugins-ml-controller, .plugins-ml-model-group, .plugins-ml-model, .plugins-ml-task,
.plugins-ml-conversation-meta, .plugins-ml-conversation-interactions, .plugins-ml-memory-meta,
.plugins-ml-memory-message, .plugins-ml-stop-words, .opendistro-alerting-config,
.opendistro-alerting-alert*, .opendistro-anomaly-results*, .opendistro-anomaly-detector*,
.opendistro-anomaly-checkpoints, .opendistro-anomaly-detection-state, .opendistro-reports-*,
.opensearch-notifications-*, .opensearch-notebooks, .opensearch-observability, .ql-datasources,
.opendistro-asynchronous-search-response*, .replication-metadata-store, .opensearch-knn-models,
.geospatial-ip2geo-data*, .plugins-flow-framework-config, .plugins-flow-framework-templates,
.plugins-flow-framework-state, .plugins-search-relevance-experiment, .plugins-search-relevance-judgment-cache]
node.max_local_storage_nodes: 3
docker-compose.yml
services:
opensearch-node:
image: opensearchproject/opensearch:3.6.0
container_name: opensearch-node
environment:
- cluster.name=opensearch-cluster
- node.name=opensearch-node
- discovery.seed_hosts=opensearch-node,opensearch-node-date
- cluster.initial_cluster_manager_nodes=opensearch-node
- node.roles=cluster_manager,data,ingest,remote_cluster_client
- node.attr.temp=hot
- bootstrap.memory_lock=true
- OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_INITIAL_ADMIN_PASSWORD}
# - "OPENSEARCH_JAVA_OPTS=-Xms6g -Xmx6g -Dopensearch.experimental.feature.telemetry.enabled=true -Dtelemetry.feature.tracer.enabled=true -Dtelemetry.tracer.enabled=true"
- "OPENSEARCH_JAVA_OPTS=-Xms6g -Xmx6g"
- OPENSEARCH_HOME=/usr/share/opensearch
- OPENSEARCH_PATH_CONF=/usr/share/opensearch/config
# - HTTP_PROXY=${HTTP_PROXY}
# - HTTPS_PROXY=${HTTPS_PROXY}
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
hard: 65536
volumes:
- opensearch-data:/usr/share/opensearch/data
- ./opensearch.yml:/usr/share/opensearch/config/opensearch.yml
- ./root-ca.pem:/usr/share/opensearch/config/root-ca.pem
- ./esnode.pem:/usr/share/opensearch/config/esnode.pem
- ./esnode-key.pem:/usr/share/opensearch/config/esnode-key.pem
- /etc/localtime:/etc/localtime
- ./test/config2.yml:/usr/share/opensearch/config/opensearch-security/config.yml
- ./test/roles_mapping.yml:/usr/share/opensearch/config/opensearch-security/roles_mapping.yml
- ./test/roles.yml:/usr/share/opensearch/config/opensearch-security/roles.yml
- ./test/internal_users.yml:/usr/share/opensearch/config/opensearch-security/internal_users.yml
ports:
- 9200:9200
- 9600:9600
networks:
- opensearch-net
opensearch-node-date:
image: opensearchproject/opensearch:3.6.0
container_name: opensearch-node-date
environment:
- cluster.name=opensearch-cluster
- node.name=opensearch-node-date
- discovery.seed_hosts=opensearch-node,opensearch-node-date
- cluster.initial_cluster_manager_nodes=opensearch-node
- node.attr.temp=warm
- node.roles=data,remote_cluster_client
- bootstrap.memory_lock=true
- OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_INITIAL_ADMIN_PASSWORD}
# - "OPENSEARCH_JAVA_OPTS=-Xms6g -Xmx6g -Dopensearch.experimental.feature.telemetry.enabled=true -Dtelemetry.feature.tracer.enabled=true -Dtelemetry.tracer.enabled=true"
- "OPENSEARCH_JAVA_OPTS=-Xms6g -Xmx6g"
- OPENSEARCH_HOME=/usr/share/opensearch
- OPENSEARCH_PATH_CONF=/usr/share/opensearch/config
# - HTTP_PROXY=${HTTP_PROXY}
# - HTTPS_PROXY=${HTTPS_PROXY}
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
hard: 65536
volumes:
- /mnt/docker_volume/opensearch_opensearch-node-date:/usr/share/opensearch/data
- ./opensearch.yml:/usr/share/opensearch/config/opensearch.yml
- ./root-ca.pem:/usr/share/opensearch/config/root-ca.pem
- ./esnode.pem:/usr/share/opensearch/config/esnode.pem
- ./esnode-key.pem:/usr/share/opensearch/config/esnode-key.pem
- /etc/localtime:/etc/localtime
- ./test/config2.yml:/usr/share/opensearch/config/opensearch-security/config.yml
- ./test/roles_mapping.yml:/usr/share/opensearch/config/opensearch-security/roles_mapping.yml
- ./test/roles.yml:/usr/share/opensearch/config/opensearch-security/roles.yml
- ./test/internal_users.yml:/usr/share/opensearch/config/opensearch-security/internal_users.yml
ports:
- 9201:9200
networks:
- opensearch-net
opensearch-dashboards:
image: opensearchproject/opensearch-dashboards:3.6.0
container_name: opensearch-dashboards
depends_on:
- opensearch-node
- opensearch-node-date
volumes:
- /etc/localtime:/etc/localtime
ports:
- 5601:5601
expose:
- "5601"
environment:
OPENSEARCH_HOSTS: '["https://opensearch-node:9200","https://opensearch-node-date:9200"]'
networks:
- opensearch-net
volumes:
opensearch-data:
# opensearch-node-date:
logstash:
networks:
opensearch-net:
POST /_cluster/allocation/explain
{ “index”: “.opensearch-sap-test-detectors-queries-optimized-d657c548-e220-48ce-9f09-c9e0a07430d4-000001”, “shard”: 0, “primary”: true }
{
"index": ".opensearch-sap-test-detectors-queries-optimized-d657c548-e220-48ce-9f09-c9e0a07430d4-000001",
"shard": 0,
"primary": true,
"current_state": "started",
"current_node": {
"id": "ySQQb38KTOOMBVxPbew6Bw",
"name": "opensearch-node",
"transport_address": "172.18.0.2:9300",
"attributes": {
"temp": "hot",
"shard_indexing_pressure_enabled": "true"
},
"weight_ranking": 1
},
"can_remain_on_current_node": "yes",
"can_rebalance_cluster": "no",
"can_rebalance_cluster_decisions": [
{
"decider": "rebalance_only_when_active",
"decision": "NO",
"explanation": "rebalancing is not allowed until all replicas in the cluster are active"
},
{
"decider": "cluster_rebalance",
"decision": "NO",
"explanation": "the cluster has unassigned shards and cluster setting [cluster.routing.allocation.allow_rebalance] is set to [indices_all_active]"
}
],
"can_rebalance_to_other_node": "no",
"rebalance_explanation": "rebalancing is not allowed",
"node_allocation_decisions": [
{
"node_id": "u9omgUBHQ-e2VPJMy9ICAA",
"node_name": "opensearch-node-date",
"transport_address": "172.18.0.3:9300",
"node_attributes": {
"temp": "warm",
"shard_indexing_pressure_enabled": "true"
},
"node_decision": "worse_balance",
"weight_ranking": 2
}
]
}
GET /.opensearch-sap-test-detectors-queries-optimized*/_settings?flat_settings=true
{
".opensearch-sap-test-detectors-queries-optimized-d657c548-e220-48ce-9f09-c9e0a07430d4-000001": {
"settings": {
"index.analysis.analyzer.rule_analyzer.char_filter": [
"rule_ws_filter"
],
"index.analysis.analyzer.rule_analyzer.tokenizer": "keyword",
"index.analysis.char_filter.rule_ws_filter.pattern": "(_ws_)",
"index.analysis.char_filter.rule_ws_filter.replacement": " ",
"index.analysis.char_filter.rule_ws_filter.type": "pattern_replace",
"index.auto_expand_replicas": "0-1",
"index.creation_date": "1779674720465",
"index.hidden": "true",
"index.mapping.total_fields.limit": "1008",
"index.number_of_replicas": "1",
"index.number_of_shards": "1",
"index.provided_name": ".opensearch-sap-test-detectors-queries-optimized-d657c548-e220-48ce-9f09-c9e0a07430d4-000001",
"index.replication.type": "DOCUMENT",
"index.uuid": "gXrcDEu8RBWdcGkaO2Wy1w",
"index.version.created": "137277827"
}
},
".opensearch-sap-test-detectors-queries-optimized-07bd22ba-da09-40c9-9eef-d73c5ed7d44b-000001": {
"settings": {
"index.analysis.analyzer.rule_analyzer.char_filter": [
"rule_ws_filter"
],
"index.analysis.analyzer.rule_analyzer.tokenizer": "keyword",
"index.analysis.char_filter.rule_ws_filter.pattern": "(_ws_)",
"index.analysis.char_filter.rule_ws_filter.replacement": " ",
"index.analysis.char_filter.rule_ws_filter.type": "pattern_replace",
"index.auto_expand_replicas": "0-1",
"index.creation_date": "1779674720524",
"index.hidden": "true",
"index.mapping.total_fields.limit": "1008",
"index.number_of_replicas": "1",
"index.number_of_shards": "1",
"index.provided_name": ".opensearch-sap-test-detectors-queries-optimized-07bd22ba-da09-40c9-9eef-d73c5ed7d44b-000001",
"index.replication.type": "DOCUMENT",
"index.uuid": "H4uECzX2Q1Whim4gLYFNhQ",
"index.version.created": "137277827"
}
}
}
GET /_cat/nodeattrs?v&h=node,attr,value
node attr value
opensearch-node temp hot
opensearch-node shard_indexing_pressure_enabled true
opensearch-node-date temp warm
opensearch-node-date shard_indexing_pressure_enabled true
GET /_cluster/settings?pretty&include_defaults=false
{
"persistent": {
"cluster": {
"default_number_of_replicas": "0",
"routing": {
"allocation": {
"disk": {
"watermark": {
"low": "20gb",
"flood_stage": "10gb",
"high": "20gb"
}
}
}
}
},
"opendistro": {
"index_state_management": {
"history": {
"number_of_replicas": "0"
}
}
}
},
"transient": {}
}