OpenSearch
OpenSearch
Discover OpenSearch indices and sample documents for detection.
- Category
- Databases
- Source type
- OPENSEARCH
- Produces
- index
OpenSearch holds the same kind of denormalised copies as any search cluster — logs, product catalogues, customer records flattened for fast retrieval — and, being log-heavy, is a frequent home for data that was never meant to be retained.
What you need to connect
The cluster URL, and either nothing, basic auth, or an API key. A read-only role scoped to the indices you want is the right level of access.
Amazon OpenSearch Service and self-managed clusters connect the same way.
What Classifyre reads
Shared behaviour · Search engines
One asset per index, not per document. The asset's content is a sample of the documents in it, serialised so a detector sees the field values; the asset's metadata records the document count and the fields the index actually contains.
Only read APIs are used — cluster info, index listing, and search. A read-only key or user is enough, and is what we recommend.
Scope by index allow- and denylist, cap the index count, and decide whether system indices are included.
Metadata on every asset
Asset kind · index
| Field | Type | Always present | What it is |
|---|---|---|---|
| index_name | string | Yes | Index name |
| health | string | No | Index health (green/yellow/red) |
| doc_count | integer | Yes | Number of documents in the index |
| store_size_bytes | integer | No | Index store size in bytes |
| primary_shards | integer | No | Number of primary shards |
| replica_shards | integer | No | Number of replica shards |
Lineage
Lineage
This source records no lineage. Nothing in the system it reads describes data moving from one place to another, so no FLOW edges are produced. Related items are still linked — see Lineage & Relationships for what those links mean and how they differ from lineage.
Worth knowing
- Log indices roll over daily. Use an allowlist pattern or a cap so a scan doesn’t spend itself on a thousand dated indices of the same shape.
Configuration
Beyond the fields below, every source also has the settings shared by all of them: the sampling strategy, the detectors to run, the scan schedule, and the compute limits for its scan jobs.
Required
Without these, the source will not save.
This section depends on which authentication method you pick — one of the following applies.
No Authentication
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "NONE" | Yes | — | — |
| url | string | Yes | Base URL of the cluster (e.g. https://localhost:9200) | — |
Basic (Username/Password)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "BASIC" | Yes | — | — |
| url | string | Yes | Base URL of the cluster (e.g. https://localhost:9200) | — |
API Key (Bearer Token)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| auth_mode | "API_KEY" | Yes | — | — |
| url | string | Yes | Base URL of the cluster (e.g. https://localhost:9200) | — |
Secrets
Stored encrypted and never shown again after you save them. See Configuration & Fields.
This section depends on which authentication method you pick — one of the following applies.
No Authentication
Secret fields · No Authentication: none for this source.
Basic (Username/Password)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| username | string | Yes | Basic auth username | — |
| password | string | Yes | Basic auth password | — |
API Key (Bearer Token)
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| api_key | string | Yes | API key or bearer token, sent as an Authorization header | — |
Optional
Everything you can tune. Sensible defaults apply when you leave them alone.
| Field | Type | Required | What it does | Default |
|---|---|---|---|---|
| optional | object | No | —no extra properties | — |
| connection | object | No | Cluster connection controls.no extra properties | — |
| connection.request_timeout_seconds | number | No | Network timeout in seconds for cluster API callsmin 1, max 300 | 30 |
| connection.verify_ssl | boolean | No | TLS certificate verification toggle | true |
| scope | object | No | Index selection scope.no extra properties | — |
| scope.exclude_indices | array | No | Index denylist | — |
| scope.exclude_indices[] | string | No | — | — |
| scope.include_indices | array | No | Optional index allowlist | — |
| scope.include_indices[] | string | No | — | — |
| scope.include_system_indices | boolean | No | Include system indices (names starting with .) | false |
| scope.index_limit | integer | No | Optional cap on number of index assetsmin 1 | — |