OpenSearch is now the default search backend in Timesketch

[berggren]

As of December 20, 2021 the Timesketch project now uses OpenSearch 1.2.2 as the default backend.

In December 2021 the Timesketch project began to test the feasibility to move our search backend from Elasticsearch to OpenSearch.

OpenSearch is a community-driven, open source search and analytics suite derived from Apache 2.0 licensed Elasticsearch 7.10.2.

Timesketch depended on the last open source version of Elasticsearch (7.10.2) that is now unmaintained. We need our search backend to provides timely security updates and OpenSearch has quickly become a viable alternative to Elasticsearch OSS 7.10.2.

As of December 20, 2021 the Timesketch project now uses OpenSearch 1.2.2 as the default backend for any new installations as well as the development environment. We will continue to update our documentation to reflect this change over the coming weeks.

What about my current Elasticsearch infrastructure?

It will still work as normal, but consider migrating to OpenSearch. Elasticsearch version 7.10.2 still works but we cannot guarantee future compatibility with new versions of Elasticsearch. The main reason being client compatibility. Your current infrastructure should work for any Elasticsearch 7.x version. That being said - consider migrating your Elasticsearch cluster to OpenSearch. Going from 7.10.2 OSS version to OpenSearch is supported and well documented. See here for the official guide on how to migrate: https://opensearch.org/docs/latest/upgrade-to/upgrade-to/ (Remember: make sure you have backups for your data using Elasticsearch snapshots before attempting any migration).

As always, please file bugs if anything is broken, or join our discussion here for any questions you might have.