Shipping events to OpenSearch

Use the OpenSearch output plugin to send Logstash events to an OpenSearch cluster. You can then search the events in OpenSearch and visualize them in OpenSearch Dashboards.

Before you start, install Logstash and the OpenSearch output plugin, OpenSearch, and, optionally, OpenSearch Dashboards.

Configuring the OpenSearch output plugin

To send events to OpenSearch, add the opensearch plugin to the output section of your pipeline configuration file. Replace <admin-password> with the password for the admin user and <path-to-root-ca> with the path to the certificate authority file that signed the OpenSearch node certificates:

output {
  opensearch {
    hosts    => ["https://localhost:9200"]
    user     => "admin"
    password => "<admin-password>"
    index    => "logstash-logs-%{+YYYY.MM.dd}"
    ssl      => true
    cacert   => "<path-to-root-ca>"
  }
}

The index setting uses the %{+YYYY.MM.dd} date pattern, so Logstash writes events to a separate index for each day, for example, logstash-logs-2026.10.16. The date comes from the @timestamp field of each event.

If you’re testing against a cluster that uses the demo security configuration, which uses self-signed certificates, you can replace the cacert setting with ssl_certificate_verification => false. Don’t disable certificate verification in production.

Example: Send JSON events to OpenSearch

To send events that you enter in the terminal to OpenSearch, follow these steps:

1. Create a file named config/pipeline.conf in the Logstash directory with the following configuration:

    input {
      stdin {
        codec => json
      }
    }
   
    output {
      opensearch {
        hosts    => ["https://localhost:9200"]
        user     => "admin"
        password => "<admin-password>"
        index    => "logstash-logs-%{+YYYY.MM.dd}"
        ssl      => true
        ssl_certificate_verification => false
      }
    }
   

   This pipeline accepts JSON input from the terminal and writes the events to the logstash-logs-%{+YYYY.MM.dd} index in an OpenSearch cluster running on localhost.

2. Start Logstash:

    bin/logstash -f config/pipeline.conf
   

3. When Logstash logs Pipeline started, enter a JSON object on a single line in the terminal:

    { "amount": 10, "quantity": 2 }
   

4. Verify that Logstash created the index. In OpenSearch Dashboards, go to Dev Tools and send the following request:

    GET _cat/indices/logstash-logs-*?v
   

   The response lists the index and its document count:

    health status index                    uuid                   pri rep docs.count docs.deleted store.size pri.store.size
    yellow open   logstash-logs-2026.10.16 iuh648LYSnmQrkGf70pplA   1   1          1            0      5.2kb          5.2kb
   

Authentication

The OpenSearch output plugin supports basic authentication and AWS Identity and Access Management (IAM) authentication.

Basic authentication

For basic authentication, provide the user and password settings, as shown in the preceding examples. Alternatively, specify the credentials in the auth_type setting:

output {
  opensearch {
    hosts => ["https://<hostname>:<port>"]
    auth_type => {
      type => "basic"
      user => "admin"
      password => "<admin-password>"
    }
    index => "logstash-logs-%{+YYYY.MM.dd}"
  }
}

The following table lists the auth_type settings for basic authentication.

AWS IAM authentication

To send events to an Amazon OpenSearch Service domain using AWS IAM authentication, set type to aws_iam in the auth_type setting. The plugin signs each request using AWS Signature Version 4:

output {
  opensearch {
    hosts => ["https://<domain-endpoint>:443"]
    auth_type => {
      type => "aws_iam"
      region => "us-west-2"
      service_name => "es"
    }
    index => "logstash-logs-%{+YYYY.MM.dd}"
  }
}

Replace <domain-endpoint> with the domain endpoint, without the https:// prefix. Amazon OpenSearch Service domains accept requests over HTTPS on port 443. The domain’s access policy must allow the IAM identity that Logstash uses to send HTTP requests to the domain.

The following table lists the auth_type settings for AWS IAM authentication.

Credential resolution

If you don’t specify credentials in the auth_type setting, the plugin uses the first credentials that it finds in the following locations, in order:

1. The aws_access_key_id and aws_secret_access_key settings in the auth_type setting.
2. The AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN environment variables. The plugin also recognizes the AWS_ACCESS_KEY and AWS_SECRET_KEY environment variables.
3. The credentials file in the default location (~/.aws/credentials).
4. The instance profile credentials provided by the Amazon EC2 instance metadata service.

To avoid storing credentials in the pipeline configuration file, use environment variables or, if Logstash runs on Amazon EC2, an instance profile.

Optional settings

The following table lists optional settings for the OpenSearch output plugin.

Data streams

Data streams are recommended for append-only time-series data, such as logs, events, and metrics. For more information, see Data streams.

To send events to a data stream, first create the data stream in OpenSearch. Then set index to the data stream name and action to create:

output {
  opensearch {
    hosts => ["https://<hostname>:<port>"]
    auth_type => {
      type => "basic"
      user => "admin"
      password => "<admin-password>"
    }
    index => "my-data-stream"
    action => "create"
  }
}

Data streams accept only create operations. If you don’t set action to create, OpenSearch rejects the events with a 400 status code.