docs.aws.amazon.com Open in urlscan Pro
13.35.58.67 Public Scan

Back to summary

URL:
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html
Submission: On June 05 via manual (June 5th 2024, 10:41:20 am UTC) from GB — Scanned from GB

Form analysis
0 forms found in the DOM

Text Content

SELECT YOUR COOKIE PREFERENCES

We use essential cookies and similar tools that are necessary to provide our
site and services. We use performance cookies to collect anonymous statistics so
we can understand how customers use our site and make improvements. Essential
cookies cannot be deactivated, but you can click “Customize cookies” to decline
performance cookies.

If you agree, AWS and approved third parties will also use cookies to provide
useful site features, remember your preferences, and display relevant content,
including relevant advertising. To continue without accepting these cookies,
click “Continue without accepting.” To make more detailed choices or learn more,
click “Customize cookies.”

Accept all cookiesContinue without acceptingCustomize cookies

CUSTOMIZE COOKIE PREFERENCES

We use cookies and similar tools (collectively, "cookies") for the following
purposes.

ESSENTIAL

Essential cookies are necessary to provide our site and services and cannot be
deactivated. They are usually set in response to your actions on the site, such
as setting your privacy preferences, signing in, or filling in forms.

PERFORMANCE

Performance cookies provide anonymous statistics about how customers navigate
our site so we can improve site experience and performance. Approved third
parties may perform analytics on our behalf, but they cannot use the data for
their own purposes.

Allow performance category
Allowed

FUNCTIONAL

Functional cookies help us provide useful site features, remember your
preferences, and display relevant content. Approved third parties may set these
cookies to provide certain site features. If you do not allow these cookies,
then some or all of these services may not function properly.

Allow functional category
Allowed

ADVERTISING

Advertising cookies may be set through our site by us or our advertising
partners and help us deliver relevant marketing content. If you do not allow
these cookies, you will experience less relevant advertising.

Allow advertising category
Allowed

Blocking some types of cookies may impact your experience of our sites. You may
review and change your choices at any time by clicking Cookie preferences in the
footer of this site. We and selected third-parties use cookies or similar
technologies as specified in the AWS Cookie Notice.

CancelSave preferences

UNABLE TO SAVE COOKIE PREFERENCES

We will only store essential cookies at this time, because we were unable to
save your cookie preferences.

If you want to change your cookie preferences, try again later using the link in
the AWS console footer, or contact support if the problem persists.

Dismiss

Create an AWS Account
1. AWS
2. ...

3. Documentation
4. Amazon OpenSearch Service
5. Developer Guide

Feedback
Preferences

AMAZON OPENSEARCH SERVICE

DEVELOPER GUIDE

* What is Amazon OpenSearch Service?
* Setting up
* Getting started
* Amazon OpenSearch Ingestion
* Setting up roles and users
* Granting pipelines access to domains
* Granting pipelines access to collections

* Getting started with OpenSearch Ingestion
* Tutorial: Ingest data into a domain
* Tutorial: Ingest data into a collection

* Pipeline features overview
* Creating pipelines
* Viewing pipelines
* Updating pipelines
* Stopping and starting pipelines
* Deleting pipelines
* Supported plugins and options
* Working with pipeline integrations
* Amazon DynamoDB
* Amazon DocumentDB
* Amazon MSK
* Amazon S3
* Amazon Security Lake
* Fluent Bit
* Fluentd
* OpenTelemetry Collector

* Migrating data between domains and collections
* Managing pipelines with the AWS SDKs
* Use cases for OpenSearch Ingestion
* Pattern matching
* Log enrichment
* Event aggregation
* Deriving metrics from logs
* Trace Analytics
* Deriving metrics from traces
* Anomaly detection
* Sampling
* Selective download

* Security in OpenSearch Ingestion
* Configuring VPC access for pipelines
* Identity and Access Management
* Monitoring with CloudTrail

* Tagging pipelines
* Logging and monitoring
* Monitoring pipeline logs
* Monitoring pipeline metrics

* Best practices

* Amazon OpenSearch Serverless
* What is Amazon OpenSearch Serverless?
* Getting started with OpenSearch Serverless
* Creating and managing collections
* Creating, listing, and deleting collections
* Working with vector search collections
* Using data lifecycle policies
* Managing collections with the AWS SDKs
* Creating collections with CloudFormation

* Managing capacity limits
* Ingesting data into collections
* Security in OpenSearch Serverless
* Getting started with security
* Tutorial: Getting started with security (console)
* Tutorial: Getting started with security (CLI)

* Identity and Access Management
* Encryption
* Network access
* Data access control
* VPC endpoints
* SAML authentication
* Compliance validation

* Tagging collections
* Supported operations and plugins
* Monitoring OpenSearch Serverless
* Monitoring with CloudWatch
* Monitoring with CloudTrail
* Monitoring with EventBridge

* Creating and managing domains
* Configuration changes
* Service software updates
* Off-peak windows
* Notifications
* Configuring a multi-AZ domain
* VPC support
* Creating index snapshots
* Upgrading domains
* Creating a custom endpoint
* Auto-Tune
* Tagging domains
* Performing administrative actions

* Working with direct queries
* Creating a data source
* Configuring a data source
* Accelerated queries
* Querying data
* Managing a data source

* Monitoring domains
* Monitoring cluster metrics
* Monitoring logs
* Monitoring audit logs
* Monitoring events
* Tutorial: Listening for OpenSearch Service events
* Tutorial: Sending SNS alerts for available updates

* Monitoring with CloudTrail

* Security
* Data protection
* Encryption at rest
* Node-to-node encryption

* Identity and Access Management
* API permissions reference
* AWS managed policies

* Cross-service confused deputy prevention
* Fine-grained access control
* Tutorial: Fine-grained access control with Cognito authentication
* Tutorial: Internal user database with basic authentication

* Compliance validation
* Resilience
* Infrastructure security
* Working with OpenSearch Service-managed VPC endpoints

* SAML authentication for OpenSearch Dashboards
* Amazon Cognito authentication for OpenSearch Dashboards
* Using service-linked roles
* VPC domain creation role
* Collection creation role
* Pipeline creation role

* Sample code
* Compressing HTTP requests
* Using the AWS SDKs

* Indexing data
* Loading streaming data into OpenSearch Service
* Loading data with Logstash

* Searching data
* Custom packages
* SQL support
* k-NN search
* Cross-cluster search
* Learning to Rank
* Asynchronous search
* Point in time
* Semantic search

* OpenSearch Dashboards
* Managing indexes
* UltraWarm storage
* Cold storage
* OR1 storage
* Index State Management
* Tutorial: Automating ISM processes

* Index rollups
* Index transforms
* Cross-cluster replication
* Remote reindex
* Data streams

* Monitoring data
* Alerting
* Anomaly detection
* Tutorial: Detect high CPU usage with anomaly detection

* Machine learning
* Connectors for AWS services
* Connectors for external platforms
* CloudFormation template integrations

* Security Analytics
* Observability
* Trace Analytics
* Piped Processing Language

* Best practices
* Sizing domains
* Petabyte scale
* Dedicated master nodes
* Recommended CloudWatch alarms

* General reference
* Supported instance types
* Features by engine version
* Plugins by engine version
* Supported operations
* Quotas
* Reserved Instances
* Other supported resources

* Tutorials
* Creating and searching for documents
* Migrating to OpenSearch Service
* Creating a search application
* Visualizing support calls

* Amazon OpenSearch Service rename
* Troubleshooting
* Document history
* AWS Glossary

Service software updates in Amazon OpenSearch Service - Amazon OpenSearch
Service
AWSDocumentationAmazon OpenSearch ServiceDeveloper Guide
Optional versus required updatesPatch updatesConsiderationsStarting an
updateOff-peak windowsMonitoring updatesWhen domains are ineligible for an
update

SERVICE SOFTWARE UPDATES IN AMAZON OPENSEARCH SERVICE

PDFRSS

NOTE

For explanations of the changes and additions made in each major (non-patch)
service software update, see the release notes.

Amazon OpenSearch Service regularly releases service software updates that add
features or otherwise improve your domains. The Notifications panel in the
console is the easiest way to see if an update is available or to check the
status of an update. Each notification includes details about the service
software update. All service software updates use blue/green deployments to
minimize downtime.

Service software updates differ from OpenSearch version upgrades. For
information about upgrading to a later version of OpenSearch, see Upgrading
Amazon OpenSearch Service domains.

TOPICS

* Optional versus required updates
* Patch updates
* Considerations
* Starting a service software update
* Scheduling software updates during off-peak windows
* Monitoring service software updates
* When domains are ineligible for an update

OPTIONAL VERSUS REQUIRED UPDATES

OpenSearch Service has two broad categories of service software updates:

OPTIONAL UPDATES

Optional service software updates generally include enhancements and support for
new features or functionality. Optional updates aren't enforced on your domains,
and there's no hard deadline to install them. The availability of the update is
communicated through email and a console notification. You can choose to apply
the update immediately or reschedule it for a more appropriate date and time.
You can also schedule it during the domain's off-peak window. The majority of
software updates are optional.

Regardless of whether or not you schedule an update, if you make a change on the
domain that causes a blue/green deployment, OpenSearch Service automatically
updates your service software for you.

You can configure your domain to automatically apply optional updates during
off-peak hours. When this option is turned on, OpenSearch Service waits at least
13 days from when an optional update is available and then schedules the update
after 72 hours (three days). You receive a console notification when the update
is scheduled and you can choose to reschedule it for a later date.

To turn on automatic software updates, select Enable automatic software update
when you create or update your domain. To configure the same setting using the
AWS CLI, set --software-update-options to true when you create or update your
domain.

REQUIRED UPDATES

Required service software updates generally include critical security fixes or
other mandatory updates to ensure the continued integrity and functionality of
your domain. Examples of required updates are Log4j Common Vulnerabilities and
Exposures (CVEs) and enforcement of Instance Metadata Service Version 2
(IMDSv2). The number of mandatory updates in a year is usually less than three.

OpenSearch Service automatically schedules these updates and notifies you 72
hours (three days) before the scheduled update through email and a console
notification. You can choose to apply the update immediately or reschedule it
for a more appropriate date and time within the allowed timeframe. You can also
schedule it during the domain's next off-peak window. If you take no action on a
required update and you don't make any domain changes that cause a blue/green
deployment, OpenSearch Service can initiate the update at any time beyond the
specified deadline (typically 14 days from availability), within the domain's
off-peak window.

Regardless of when the update is scheduled for, if you make a change on the
domain that causes a blue/green deployment, OpenSearch Service automatically
updates your domain for you.

PATCH UPDATES

Service software versions that end in "-P" and a number, such as R20211203-P4,
are patch releases. Patches are likely to include performance improvements,
minor bug fixes, and security fixes or posture improvements. Patch releases do
not include new features or breaking changes, and they generally don't have a
direct or noticeable impact on users. The service software notification tells
you if a patch release is optional or mandatory.

CONSIDERATIONS

Consider the following when deciding whether to update your domain:

* Manually updating your domain lets you take advantage of new features more
quickly. When you choose Update, OpenSearch Service places the request in a
queue and begins the update when it has time.

* When you initiate a service software update, OpenSearch Service sends a
notification when the update starts and when it completes.

* Software updates use blue/green deployments to minimize downtime. Updates can
temporarily strain a cluster's dedicated master nodes, so make sure to
maintain sufficient capacity to handle the associated overhead.

* Updates typically complete within minutes, but can also take several hours or
even days if your system is experiencing heavy load. Consider updating your
domain during the configured off-peak window to avoid long update periods.

STARTING A SERVICE SOFTWARE UPDATE

You can request a service software update through the OpenSearch Service
console, the AWS CLI, or one of the SDKs.

TO REQUEST A SERVICE SOFTWARE UPDATE

1. Open the Amazon OpenSearch Service console at
https://console.aws.amazon.com/aos/home.

2. Select the domain name to open its configuration.

3. Choose Actions, Update and select one of the following options:

* Apply update now - Immediately schedules the action to happen in the
current hour if there's capacity available. If capacity isn't available,
we provide other available time slots to choose from.

* Schedule it in off-peak window – Only available if the off-peak window is
enabled for the domain. Schedules the update to take place during the
domain's configured off-peak window. There's no guarantee that the update
will happen during the next immediate window. Depending on capacity, it
might happen in subsequent days. For more information, see Scheduling
software updates during off-peak windows.

* Schedule for specific date and time – Schedules the update to take place
at a specific date and time. If the time that you specify is unavailable
for capacity reasons, you can select a different time slot.

If you schedule the update for a later date (within or outside the domain's
off-peak window), you can reschedule it at any time. For instructions, see
Rescheduling actions.

4. Choose Confirm.

CONSOLE

TO REQUEST A SERVICE SOFTWARE UPDATE

1. Open the Amazon OpenSearch Service console at
https://console.aws.amazon.com/aos/home.

2. Select the domain name to open its configuration.

3. Choose Actions, Update and select one of the following options:

* Apply update now - Immediately schedules the action to happen in the
current hour if there's capacity available. If capacity isn't available,
we provide other available time slots to choose from.

If you schedule the update for a later date (within or outside the domain's
off-peak window), you can reschedule it at any time. For instructions, see
Rescheduling actions.

4. Choose Confirm.

Send a start-service-software-update AWS CLI request to initiate a service
software update. This example adds the update to the queue immediately:

aws opensearch start-service-software-update \
--domain-name my-domain \
--schedule-at "NOW"

Response:

{
"ServiceSoftwareOptions": {
"CurrentVersion": "R20220928-P1",
"NewVersion": "R20220928-P2",
"UpdateAvailable": true,
"Cancellable": true,
"UpdateStatus": "PENDING_UPDATE",
"Description": "",
"AutomatedUpdateDate": "1969-12-31T16:00:00-08:00",
"OptionalDeployment": true
}
}

TIP

After you request an update, you have a narrow window of time in which you can
cancel it. The duration of this PENDING_UPDATE state can vary greatly and
depends on your AWS Region and the number of concurrent updates that OpenSearch
Service is performing. To cancel an update, use the console or
cancel-service-software-update AWS CLI command.

If the request fails with a BaseException, it means that the time you specified
isn't available for capacity reasons, and you must specify a different time.
OpenSearch Service provides alternate available slot suggestions in the
response.

AWS CLI

Send a start-service-software-update AWS CLI request to initiate a service
software update. This example adds the update to the queue immediately:

aws opensearch start-service-software-update \
--domain-name my-domain \
--schedule-at "NOW"

Response:

TIP

This sample Python script uses the describe_domain and
start_service_software_update methods from the AWS SDK for Python (Boto3) to
check whether a domain is eligible for a service software update and if so,
starts the update. You must provide a value for domain_name.

import boto3
from botocore.config import Config
import time

# Build the client using the default credential configuration.
# You can use the CLI and run 'aws configure' to set access key, secret
# key, and default region.

my_config = Config(
# Optionally lets you specify a Region other than your default.
region_name='us-east-1'
)

domain_name = '' # The name of the domain to check and update

client = boto3.client('opensearch', config=my_config)

def getUpdateStatus(client):
"""Determines whether the domain is eligible for an update"""
response = client.describe_domain(
DomainName=domain_name
)
sso = response['DomainStatus']['ServiceSoftwareOptions']
if sso['UpdateStatus'] == 'ELIGIBLE':
print('Domain [' + domain_name + '] is eligible for a service software update from version ' +
sso['CurrentVersion'] + ' to version ' + sso['NewVersion'])
updateDomain(client)
else:
print('Domain is not eligible for an update at this time.')

def updateDomain(client):
"""Starts a service software update for the eligible domain"""
response = client.start_service_software_update(
DomainName=domain_name
)
print('Updating domain [' + domain_name + '] to version ' +
response['ServiceSoftwareOptions']['NewVersion'] + '...')
waitForUpdate(client)

def waitForUpdate(client):
"""Waits for the domain to finish updating"""
response = client.describe_domain(
DomainName=domain_name
)
status = response['DomainStatus']['ServiceSoftwareOptions']['UpdateStatus']
if status == 'PENDING_UPDATE' or status == 'IN_PROGRESS':
time.sleep(30)
waitForUpdate(client)
elif status == 'COMPLETED':
print('Domain [' + domain_name +
'] successfully updated to the latest software version')
else:
print('Domain is not currently being updated.')

def main():
getUpdateStatus(client)

AWS SDKS

import boto3
from botocore.config import Config
import time

# Build the client using the default credential configuration.
# You can use the CLI and run 'aws configure' to set access key, secret
# key, and default region.

my_config = Config(
# Optionally lets you specify a Region other than your default.
region_name='us-east-1'
)

domain_name = '' # The name of the domain to check and update

client = boto3.client('opensearch', config=my_config)

def main():
getUpdateStatus(client)

SCHEDULING SOFTWARE UPDATES DURING OFF-PEAK WINDOWS

Each OpenSearch Service domain created after February 16, 2023 has a daily
10-hour window between 10:00 P.M. and 8:00 A.M. local time that we consider the
off-peak window. OpenSearch Service uses this window to schedule service
software updates for the domain. Off-peak updates help to minimize strain on a
cluster's dedicated master nodes during higher traffic periods. OpenSearch
Service can't initiate updates outside of this 10-hour window without your
consent.

* For optional updates, OpenSearch Service notifies you of the update's
availability and prompts you to schedule the update during an upcoming
off-peak window.

* For required updates, OpenSearch Service automatically schedules the update
during an upcoming off-peak window and notifies you three days ahead of time.
You can reschedule the update (for within or outside the off-peak window),
but only within the required timeframe for the update to be completed.

For each domain, you can choose to override the default 10:00 P.M. start time
with a custom time. For instructions, see Configuring a custom off-peak window.

TO SCHEDULE AN UPDATE DURING AN UPCOMING OFF-PEAK WINDOW

1. Open the Amazon OpenSearch Service console at
https://console.aws.amazon.com/aos/home.

2. Select the domain name to open its configuration.

3. Choose Actions, Update.

4. Select Schedule it in off-peak window.

5. Choose Confirm.

You can view the scheduled action on the Off-peak window tab and reschedule it
at any time. See Viewing scheduled actions.

CONSOLE

TO SCHEDULE AN UPDATE DURING AN UPCOMING OFF-PEAK WINDOW

1. Open the Amazon OpenSearch Service console at
https://console.aws.amazon.com/aos/home.

2. Select the domain name to open its configuration.

3. Choose Actions, Update.

4. Select Schedule it in off-peak window.

5. Choose Confirm.

You can view the scheduled action on the Off-peak window tab and reschedule it
at any time. See Viewing scheduled actions.

To schedule an update during an upcoming off-peak window using the AWS CLI, send
a StartServiceSoftwareUpdate request and specify OFF_PEAK_WINDOW for the
--schedule-at parameter:

aws opensearch start-service-software-update \
--domain-name my-domain \
--schedule-at "OFF_PEAK_WINDOW"

CLI

To schedule an update during an upcoming off-peak window using the AWS CLI, send
a StartServiceSoftwareUpdate request and specify OFF_PEAK_WINDOW for the
--schedule-at parameter:

aws opensearch start-service-software-update \
--domain-name my-domain \
--schedule-at "OFF_PEAK_WINDOW"

MONITORING SERVICE SOFTWARE UPDATES

OpenSearch Service sends a notification when a service software update is
available, required, started, completed, or failed. You can view these
notifications on the Notifications panel of the OpenSearch Service console. The
notification severity is Informational if the update is optional and High if
it's required.

OpenSearch Service also sends service software events to Amazon EventBridge. You
can use EventBridge to configure rules that send an email or perform a specific
action when an event is received. For an example walkthrough, see Tutorial:
Sending Amazon SNS alerts for available software updates.

To see the format of each service software event sent to Amazon EventBridge, see
Service software update events.

WHEN DOMAINS ARE INELIGIBLE FOR AN UPDATE

Your domain is ineligible for a service software update if it's in any of the
following states:

State Description Domain in processing

The domain is in the middle of a configuration change. Check update eligibility
after the operation completes.

Red cluster status

One or more indexes in the cluster is red. For troubleshooting steps, see Red
cluster status.

High error rate

The OpenSearch cluster is returning a large number of 5xx errors when attempting
to process requests. This problem is usually the result of too many simultaneous
read or write requests. Consider reducing traffic to the cluster or scaling your
domain.

Split brain

Split brain means your OpenSearch cluster has more than one master node and has
split into two clusters that never will rejoin on their own. You can avoid split
brain by using the recommended number of dedicated master nodes. For help
recovering from split brain, contact AWS Support.

Amazon Cognito integration issue

Your domain uses authentication for OpenSearch Dashboards, and OpenSearch
Service can't find one or more Amazon Cognito resources. This problem usually
occurs if the Amazon Cognito user pool is missing. To correct the issue,
recreate the missing resource and configure the OpenSearch Service domain to use
it.

Other service issue

Issues with OpenSearch Service itself might cause your domain to display as
ineligible for an update. If none of the previous conditions apply to your
domain and the problem persists for more than a day, contact AWS Support.

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please
refer to your browser's Help pages for instructions.

Document Conventions
Configuration changes
Off-peak windows
Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of
it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.

DID THIS PAGE HELP YOU?

Yes
No
Provide feedback

NEXT TOPIC:

Off-peak windows

PREVIOUS TOPIC:

Configuration changes

NEED HELP?

* Try AWS re:Post
* Connect with an AWS IQ expert

ON THIS PAGE

* Optional versus required updates
* Patch updates
* Considerations
* Starting an update
* Off-peak windows
* Monitoring updates
* When domains are ineligible for an update

docs.aws.amazon.com Open in urlscan Pro 13.35.58.67 Public Scan

Form analysis 0 forms found in the DOM

Text Content

docs.aws.amazon.com Open in urlscan Pro
13.35.58.67 Public Scan

Form analysis
0 forms found in the DOM