OpenSearch
Workspace 0.5.0 adds a read-only OpenSearch connection for cluster diagnostics, mappings, document browsing and bounded JSON searches. The tested server is self-managed OpenSearch 3.3.2 with the Security plugin. The connection requires OpenSearch 3 or later, but that check does not establish compatibility with every later version.
Elasticsearch, AWS SigV4 authentication, managed OpenSearch and serverless deployments are outside the tested scope. This release does not provide k-NN queries, vector recall measurements or search/indexing throughput charts.
Connect
| Setting | Notes |
|---|---|
| Host and port | REST endpoint; port 9200 by default. Enter the host, not a URL or path. |
| User and password | HTTP Basic authentication. Passwords stay in the operating system's secret store. Anonymous access works only when the server permits it. |
| Index or alias | Optional connection scope. Use one concrete index or alias; wildcard patterns, multiple-index lists and system indices are refused. An alias's targets are controlled by the server, so use index grants for access control. |
| TLS | Require TLS to verify the server certificate and hostname. A local PEM CA bundle can be supplied for private certificates. |
| SSH | Forward the configured REST endpoint through a bastion. HTTPS through SSH requires the database's DNS hostname so the original hostname can be verified. |
TLS tests cover direct and locally forwarded endpoints, trusted private CAs and rejection of wrong hostnames or untrusted certificates. They do not constitute certification of every bastion or managed service.
Views
- Overview: cluster health, visible index count and connection round-trip latency. Missing permissions are shown explicitly. The latency chart measures a root-endpoint request, not search performance.
- Indices: up to 200 visible, open, non-system indices, or the configured scope.
- Nodes: up to 200 reported nodes and their available metadata.
- Shards: allocation information for the selected index.
- Mappings: fields, including nested fields and multi-fields, capped at 1,000 displayed rows.
- Documents: manual pages of 50 documents. Documents are not polled in the background.
- Access & limits: account-permission evidence and enforced request limits; refreshed manually.
- Search console: read-only JSON search with local history, saved queries and CSV/JSON export.
Connection validation needs access to the server's root endpoint to read its version (cluster:monitor/main with the Security plugin). Monitoring and mapping endpoints need their own permissions. An account can have search access while diagnostics are unavailable. Workspace does not replace missing data with zeroes or silently grant privileges.
Search example
{
"index": "merchant-events",
"query": {
"bool": {
"filter": [{ "term": { "country": "JP" } }],
"must_not": [{ "term": { "status": "review" } }]
}
},
"size": 20,
"from": 0,
"sort": [{ "risk_score": "desc" }],
"_source": ["merchant", "country", "risk_score"]
}
Omit index when the connection already has a scope. The accepted top-level fields are index, query, size, from, sort and _source. Query operators include match_all, match_none, match, match_phrase, term, terms, range, exists, ids and bool with must, filter, should and must_not. minimum_should_match accepts an integer.
Arbitrary REST paths, writes, scripts, aggregations, inference, external term lookups, PIT and scroll are not available. Workspace disables default search pipelines on its search requests. A saved query follows the same checks as a newly entered one.
Request limits
| Limit | Value |
|---|---|
| Query input | 64 KiB; up to 8 query levels and 100 clauses |
| Documents per search | Default 100; maximum 1,000 |
| Pagination window | from + size at most 10,000 |
| Response size | At most 8 MiB, including streamed responses |
| Search timeout | 5 seconds on the server |
| Coordinating cancellation interval | 8 seconds on the server |
| Client deadline | 10 seconds per HTTP request; 5-second connection timeout |
| Early termination | 10,000 matching hits per shard |
These limits do not provide a global scan or CPU budget. A small result can still require expensive work, and the server may take time to process a timeout or cancellation. Workspace labels timed-out, early-terminated or incomplete results. Stop waiting drops the client request; it does not guarantee that server work has already stopped.
Exports include displayed results only, not an index backup. IDs, total-hit counts and table cells preserve their displayed string values; document fields appear as JSON text where applicable. See query history and export.
Permissions and production
The adapter always uses read-only operations, including when connected with an administrator account or when a saved configuration disables Safe Mode. This does not make the account itself read-only.
Access & limits reads Security authentication and role metadata with GET requests. It flags visible write or administration grants when found. Otherwise it reports the account's permissions as unverified: restricted role visibility, custom action groups and external authorization can prevent a complete assessment. Workspace never sends a trial write to test permissions.
Use a dedicated account with only the index-read and monitoring permissions you need. Have its effective grants checked, including inherited roles. Keep server-side resource limits in place, and use separate analytics/search capacity for expensive exploration where appropriate. For general guidance, see Safe Mode and production access.
Test first against an isolated database with synthetic data. The Workspace repository includes an OpenSearch 3.3.2 Docker fixture with restricted reader accounts; tests verify reads, denied writes, missing monitoring permissions, paging, cancellation, reconnect and TLS. A separate managed database or VPS can also be used as a test environment without involving production.