Skip to content

OpenSearch

Jump to bottom
pS3ud0RAnD0m edited this page Jul 18, 2026 · 5 revisions

API and storage plane for the Anomalous Vectors OpenSearch stack. For installation and lifecycle commands, see Home - Quick Start. For interactive exploration after documents are indexed, see OpenSearch Dashboards.

After the stack is up

Once the cluster is healthy, external tools write documents into indexes. This page covers how to reach the API, confirm that data arrived, inspect and query indexes, and avoid common pitfalls. Index schemas, field naming, and exporter settings belong with each ingest tool. For Burp Suite–oriented export, see the Burp Exporter wiki.

Typical next steps:

  • Confirm cluster health and that expected indexes exist
  • Inspect mappings, counts, and sample documents before deeper review in Dashboards
  • Refresh indexes when recent writes are not yet searchable
  • Point additional clients at a stable URL, credentials, and TLS posture

Endpoints

Context URL
From the host https://127.0.0.1:9200
Inside the Docker network https://opensearch.url:9200 (Compose alias)

TLS uses a self-signed certificate created on first start under ${DATA_VOLUME_ROOT}/certs (see Home - TLS certificates for filenames and custom certs). For local clients, use insecure-TLS options (for example curl -sk) or trust root-ca.pem deliberately.

Authenticate with HTTP basic auth as user admin and the password established at first start (see Home - Admin password).

Cross-platform curl notes

  • On Windows PowerShell 5.1, use curl.exe (not bare curl, which is an alias for Invoke-WebRequest) so flags such as -sk and -u match Linux and macOS.
  • Keep simple GETs on one line; they copy cleanly everywhere.
  • For JSON request bodies, write a small file and pass --data-binary "@filename.json". That avoids shell-specific escaping differences between Bash, zsh, and PowerShell.
  • Examples use admin:admin only as a local default. Replace the password when yours differs.

Validate the API

curl -sk -u "admin:admin" "https://127.0.0.1:9200/_cluster/health?pretty"
curl -sk -u "admin:admin" "https://127.0.0.1:9200/_cat/nodes?v"
curl -sk -u "admin:admin" "https://127.0.0.1:9200/_cat/indices?v&s=index"
curl -sk -u "admin:admin" "https://127.0.0.1:9200/_plugins/_security/authinfo?pretty"

Unauthenticated requests typically return 401, which still indicates that the HTTPS endpoint is reachable.

Single-node cluster status

A yellow cluster status on a one-node deployment is common when indexes request replicas that cannot be assigned. Primary shards remain available for read and write. Treat red (or transport failures) as the serious failure modes.

Working with indexed data

Replace YOUR_INDEX with the index name created by your ingest path.

Count, mapping, and sample documents

curl -sk -u "admin:admin" "https://127.0.0.1:9200/YOUR_INDEX/_count?pretty"
curl -sk -u "admin:admin" "https://127.0.0.1:9200/YOUR_INDEX/_mapping?pretty"
curl -sk -u "admin:admin" "https://127.0.0.1:9200/YOUR_INDEX/_search?pretty&size=10"

Wildcard index expressions are supported when your naming scheme uses a shared prefix, for example:

curl -sk -u "admin:admin" "https://127.0.0.1:9200/*tool-burp-traffic/_search?pretty&size=1&filter_path=hits.total,hits.hits._index"

Use filter_path (or a small size) when indexes may contain large HTTP bodies or other sensitive payloads you do not want printed to the terminal.

Query with a JSON body (file form)

Create query.json:

{
  "query": { "match_all": {} },
  "size": 10
}

Then:

curl -sk -u "admin:admin" -X GET "https://127.0.0.1:9200/YOUR_INDEX/_search?pretty" \
  -H "Content-Type: application/json" --data-binary "@query.json"

On Windows PowerShell, keep the command on one line or use the PowerShell line-continuation backtick; the important part is --data-binary "@query.json".

Make recent writes searchable

OpenSearch near-real-time search can lag briefly after bulk ingest. Force a refresh when you need documents visible immediately:

curl -sk -u "admin:admin" -X POST "https://127.0.0.1:9200/YOUR_INDEX/_refresh?pretty"

Delete an index

Destructive. Confirm the name first with _cat/indices.

curl -sk -u "admin:admin" -X DELETE "https://127.0.0.1:9200/YOUR_INDEX?pretty"

Destination for ingest clients

Setting Typical local value
Base URL https://127.0.0.1:9200 (or https://<accessibleIPOrHostname>:9200)
Username admin (Insecure default, but can be changed)
Password Your OpenSearch password
TLS Self-signed; disable verification or trust the certificate as your policy allows

Tool-specific options remain with that tool. Burp-oriented setup: Burp Exporter / its wiki.

See also

Clone this wiki locally