Setting the file. One moment.
Chapter 45 · Amazon Opensearch Service
Subchapter 45.21
references/provisioning-monitoring.mdMarkdown3 KBView on GitHub
Note: Enable OpenSearch application logs (index slow logs, search slow logs, error logs, audit logs) and configure CloudTrail for API-level auditing. Store logs in encrypted CloudWatch Logs groups (specify at log group creation: ).
--kms-key-idaws logs create-log-group --log-group-name /aws/opensearch/my-domain --kms-key-id arn:aws:kms:<region>:<account>:key/<key-id>| Metric | Threshold | Action |
|---|---|---|
CPUUtilization | > 80% sustained | Scale up instance type or add nodes |
JVMMemoryPressure | > 80% | Increase instance size; check for large aggregations |
ClusterStatus.red | = 1 | Immediate: check for unassigned shards |
ClusterStatus.yellow | = 1 | Investigate: replica shards not allocated |
FreeStorageSpace | < 20 GB (adjust based on provisioned storage) | Add EBS capacity or migrate old indices to UltraWarm |
SearchLatency | > 500ms p99 | Optimize queries; consider adding data nodes |
IndexingLatency | > 100ms p99 | Check bulk queue; scale indexing capacity |
ThreadpoolSearchRejected | > 0 | Search queue full; scale or throttle clients |
aws cloudwatch put-metric-alarm --alarm-name aos-cluster-red \
--namespace AWS/ES --metric-name ClusterStatus.red \
--dimensions Name=DomainName,Value=my-domain Name=ClientId,Value=<account-id> \
--statistic Maximum --period 60 --evaluation-periods 1 \
--threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \
--alarm-actions arn:aws:sns:<region>:<account>:my-alertsREQUIRED: SNS topics receiving CloudWatch alarms MUST have KMS encryption enabled. CloudWatch alarm notifications may contain cluster status, metric values, and other sensitive operational data. Enable encryption when creating the topic:
aws sns create-topic --name my-alerts \ --attributes KmsMasterKeyId=alias/aws/snsFor existing topics:
aws sns set-topic-attributes --topic-arn <arn> --attribute-name KmsMasterKeyId --attribute-value alias/aws/snsVerify all SNS subscription recipients belong to authorized personnel before deploying alarms.
aws cloudwatch put-metric-alarm --alarm-name aos-jvm-pressure \
--namespace AWS/ES --metric-name JVMMemoryPressure \
--dimensions Name=DomainName,Value=my-domain Name=ClientId,Value=<account-id> \
--statistic Maximum --period 300 --evaluation-periods 3 \
--threshold 80 --comparison-operator GreaterThanOrEqualToThreshold \
--alarm-actions arn:aws:sns:<region>:<account>:my-alertsaws cloudwatch put-metric-alarm --alarm-name aos-low-storage \
--namespace AWS/ES --metric-name FreeStorageSpace \
--dimensions Name=DomainName,Value=my-domain Name=ClientId,Value=<account-id> \
--statistic Minimum --period 300 --evaluation-periods 1 \
--threshold 20480 --comparison-operator LessThanOrEqualToThreshold \
--alarm-actions arn:aws:sns:<region>:<account>:my-alertsFor production domains, create alarms for: