This page provides the technical capabilities and limitations of the Cloud Analytics with OpenSearch™ offer.
We continuously improve our offers. You can follow and submit ideas to add to our roadmap.
Capabilities and limitations
Supported regions
To view Cloud Analytics availability, please see our regions and availability webpage.
Entire instances have to be in the same region.
OpenSearch versions
The Cloud Analytics offer supports the following OpenSearch™ versions:
- OpenSearch™ 2
Please refer to the Lifecycle policy guide for recommendations on version upgrades and end-of-life announcements of major versions. Additionally, you can follow the OpenSearch™ version history on their official page.
OpenSearch clients and plugin compatibility
You can use any of the OpenSearch™-recommended clients and plugins to access and populate your instance.
Plans
Three plans are available:
- Essential: 1 node
- Business: 3 nodes
- Enterprise: 6 nodes
Your choice of plan affects the number of nodes your cluster can run, the SLA, and a few other features, such as backup retention.
License type
OpenSearch™ software is under the Apache 2.0 license, a liberal open-source license. More information can be found here.
Hardware resources
For detailed information about node types and pricing, please refer to our pricing page.
Features
Plugins enabled by default
Here is the list of plugins enabled by default:
- ICU Analysis
- Phonetic Analysis
- kuromoji (Japanese Analysis)
- Mapper Size
- Open Distro for Elasticsearch SQL plugin
- Open Distro for Elasticsearch Alerting plugin
- Anomaly detection
- Asynchronous search
- Index Management
- k-NN
- Notebooks
- Performance Analyzer
- OpenSearch™ Dashboards Reports
- Scheduler for Dashboards Reports
- OpenSearch™ Dashboards GANTT Charts
- OpenSearch™ Dashboards Trace Analytics
Network
OpenSearch™ clusters are reachable through the port defined in the OVHcloud Control Panel.
Public as well as private networking (vRack) can be used for all the offers.
Ingress and Egress traffic are included in the service plans and are unmetered.
The service's IP address is subject to change periodically. Thus, it is advised not to rely on these IPs for any configuration, such as connection or egress policy. Instead, utilize the provided DNS record and implement CIDR-based egress policies for more robust and flexible network management.
Private network considerations
Here are some considerations to take into account when using a private network:
- Network ports are created in the private network of your choice. Thus, further operations on that network might be restricted - e.g., you won’t be able to delete the network if you didn’t stop the services first.
- When connecting from an outside subnet, the OpenStack IP gateway must be enabled in the subnet used for the Analytics service. The customer is responsible for any other custom network setup.
- Subnet sizing should include considerations for service nodes, other co-located services within the same subnet, and an allocation of additional available IP addresses for maintenance purposes. Failure to adequately size subnets could result in operational challenges and the malfunctioning of services.
- OpenStack subnet routes announcement will not be applied to your services.
- You can only create private network services if you are the original owner of the network. You cannot create private network services on a shared network.
Authorized IPs
Once your service is up and running, you will be able to specify IP addresses (or CIDR blocks) to authorize incoming traffic. Until then, your service will be unreachable.
Advanced parameters
You can further customize your OpenSearch™ by using advanced parameters. See our Advanced parameters references guide for more information on the supported parameters.
Backups
Essential plan clusters are automatically backed up hourly and daily during their maintenance window. Backup retention is 24 hours for hourly backups and 3 days for daily backups.
Business plan clusters are automatically backed up hourly and daily during their maintenance window. Backup retention is 24 hours for hourly backups and 14 days for daily backups.
Enterprise plan clusters are automatically backed up hourly and daily during their maintenance window. Backup retention is 24 hours for hourly backups and 30 days for daily backups.
See our Automated backups guide for more information.
Logs and metrics
Logs and metrics are available through the Control Panel and API and can be forwarded to Logs Data Platform. Additionally, cross-service integration can be configured to leverage your logs and metrics in other Cloud Databases and Analytics services. You could then view your OpenSearch™ metrics in Dashboards. See our Set up a service integration guide for more information.
For more details on logs forwarding, see our How to set up logs forwarding guide.
- Logs retention: 1000 lines of logs
- Metrics retention: 1 calendar month
Please note that if the instance is deleted, logs and metrics are also automatically deleted.
Access control (ACL)
We support index-level access control lists (ACLs) to control permissions. This approach allows you to limit the operations that are available to specific connections and to restrict access to certain data sets, which improves the security of your data.
You can grant the following permissions:
- deny: no access
- admin: full access to APIs and documents
- readwrite: full access to documents
- read: allow only searching and retrieving documents
- write: allow updating, adding, and deleting documents
Note: Write permission allows the service user to create new indexes that match the pattern, but it does not allow the deletion of those indexes.
Rules are defined separately for each user as pattern/permission combinations. The pattern defines the indexes that the permission applies to. Patterns are glob-style, where * matches any number of characters and ? matches any character.
When multiple rules match, they are applied in the order listed above. If no rules match, access is denied.
Controlling access to top-level APIs
OpenSearch™ has several “top-level” API endpoints (_mget, _msearch, and so on), where you have to grant access separately. To do this, use patterns similar to the index patterns, for example:
- _*/admin would grant unlimited access to all top-level APIs
- _msearch/admin grants unlimited access to the _msearch API only
Access control and OpenSearch™ Dashboards
Enabling ACLs does not restrict access to OpenSearch™ Dashboards, but all requests made by OpenSearch™ Dashboards are checked against the current user’s ACLs.
In practice, for OpenSearch™ Dashboards to function properly, you must grant the user admin-level access to the _msearch interface (permission: admin, pattern: _msearch) or switch on the ExtendedAcl option.
Data encryption
For detailed information about encryption, see our Security Overview guide.
Go further
For more information and tutorials, please see our other Managed Databases & Analytics or Platform as a Service guides. You can also explore the guides for other OVHcloud products and services.