Amazon OpenSearch Service - Amazon Managed Grafana

Amazon OpenSearch Service

With Amazon Managed Grafana, you can add the Amazon OpenSearch Service as a data source by using the AWS data source configuration option in the Grafana workspace console. This data source supports Amazon OpenSearch clusters and other OpenSearch clusters.

The AWS data source configuration option simplifies adding the Amazon OpenSearch Service as a data source by discovering your existing OpenSearch accounts and manages the configuration of the authentication credentials that are required to access OpenSearch. You can use this method to set up authentication and add the Amazon OpenSearch Service as a data source, or you can manually set up the data source and the necessary authentication credentials using the same method that you would on a self-managed Grafana server.

The Amazon OpenSearch Service data source supports piped processing language (PPL). For more information about PPL, see Querying Amazon OpenSearch Service data using Piped Processing Language.

You can use the Amazon OpenSearch Service data source to do many types of simple or complex OpenSearch Service queries to visualize logs or metrics stored in OpenSearch Service. You can also annotate your graphs with log events stored in OpenSearch Service.

OpenSearch settings

Name Description
Name The data source name. This is how you see the data source in panels and queries.
Default Default data source means that it will be pre-selected for new panels.
Url The HTTP protocol, IP, and port of your OpenSearch Service server.
Access Server (default) = URL must be accessible from the Grafana backend/server. Browser = URL must be accessible from the browser.

Access mode controls how requests to the data source will be handled. Server should be the preferred way if nothing else is stated.

Server access mode (default)

All requests are made from the browser to Grafana backend or server, which forwards the requests to the data source, circumventing possible Cross-Origin Resource Sharing (CORS) requirements. If you select this access mode, the URL must be accessible from the Grafana backend or server.

Browser (direct) access

Amazon Managed Grafana does not support browser direct access.

Index settings

Here you can specify a default for the time field and specify the name of your OpenSearch Service index. You can use a time pattern for the index name or a wildcard character.

OpenSearch Service version

Be sure to specify your OpenSearch version in the version selection dropdown list. This is important because there are differences in how queries are composed. Currently the versions available are 2.x, 5.x, 5.6+, 6.0+, or 7.0+. The value 5.6+ means version 5.6 or higher, but lower than 6.0. The value 6.0+ means version 6.0 or higher, but lower than 7.0. Finally, 7.0+ means version 7.0 or higher, but lower than 8.0.

Min time interval

A lower limit for the auto group by time interval. Recommended to be set to write frequency; for example, 1m if your data is written every minute. This option can also be overridden/configured in a dashboard panel under data source options. This value must be formatted as a number followed by a valid time identifier; for example, 1m (1 minute) or 30s (30 seconds). The following time identifiers are supported.

Identifier Description
y Year
M Month
w Week
d Day
h Hour
m Minute
s Second
ms Millisecond

Logs

Two parameters, Message field name and Level field name, can optionally be configured from the data source settings page that determine which fields will be used for log messages and log levels when visualizing logs in Explore.

For example, if you use a default setup of Filebeat for shipping logs to OpenSearch Service, the following configuration should work.

  • Message field name: message

  • Level field name: fields.level

Data links create a link from a specified field that can be accessed in logs view in Explore.

Each data link configuration consists of the following:

  • Field – Name of the field used by the data link.

  • URL/query – If the link is external, then enter the full link URL. If the link is internal link, then this input serves as query for the target data source. In both cases, you can interpolate the value from the field with ${__value.raw } macro.

  • Internal link – Select this if the link is internal or external. If the link is internal, a data source selector allows you to select the target data source. Only tracing data sources are supported.