Connect to an OpenSearch cluster

To connect to an OpenSearch cluster, connect to nodes in a group with the Manager, Data, or Dashboard role. The choice of node to connect to depends on the purpose of your connection — for example, if you need access to the cluster dashboard, you must connect to a node from the group with the Dashboard role. For more information about node groups and their roles, see the Node Groups guide.

You can:

• connect to nodes in a group with the Manager and Data roles — via code with SSL;
• connect to a node in a group with the Dashboard role — via the OpenSearch Dashboards web interface or OpenSearch API.

TLS(SSL) encryption is supported only when connecting via a private IP address.

When connecting, specify the port and address.

Connection ports

Use port 9200 to connect to cluster nodes.

Connection addresses

The connection address depends on where you are connecting from. You can choose an address based on one of the following scenarios:

• connecting to a cluster from a private subnet;
• connecting to a cluster from the internet.

Connecting to a cluster from a private subnet

If you are connecting to a cluster from a private subnet, use the private IP address.

To connect from a different private subnet, first connect both private subnets to a cloud router.

You can view the connection address in the Control panel.

Connecting to a cluster from the internet

If you are connecting to a cluster from the internet, use a public IP address. The private subnet must meet the requirements. If the subnet does not meet the requirements, prepare it for a public IP address connection.

You can view the connection address in the Control panel.

View connection address

1. In the Control panel, on the top menu, click Products and select Managed Databases.
2. Open the Active tab.
3. Open the database cluster page → Connection tab.
4. In the Connection addresses block, open the tab for the node group whose addresses you want to view.

Connect to nodes in a group with the Manager and Data roles

You can connect to nodes in a group with the Manager and Data roles with SSL only via a private IP address. Using TLS(SSL) encryption ensures a secure connection between your server and the Managed Databases cluster.

Bash

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Connect to the node:

   curl -XGET -u 'admin:<password>' --cacert ~/.opensearch/root.crt 'https://<ip_address>:<port>/'

   Specify:

   • <password> — administrator password; ;
   • <ip_address> — node IP address; ;
   • <port> — connection port.

Python

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Install the opensearch-py library:

   pip3 install opensearch-py

3. Connect to the node:

   from opensearchpy import OpenSearch
   
   hosts = ['<host_1>',
           '<host_2>']
   auth = ('admin', '<password>')
   ca_certs_path = '~/.opensearch/root.crt'
   
   client = OpenSearch(
       hosts,
       http_auth = auth,
       use_ssl = True,
       verify_certs = True,
       ssl_assert_hostname = False,
       ssl_show_warn = False,
       ca_certs = ca_certs_path
   )
   
   print(client.info())

   Specify:

   • <host_1> and <host_2> — node IP addresses; ;
   • <password> — administrator password.

Go

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Use the connection example:

   package main
   
   import (
       "crypto/tls"
       "crypto/x509"
       "fmt"
       "io/ioutil"
       "github.com/opensearch-project/opensearch-go"
       "net/http"
       "os"
   )
   
   func main() {
       caCert, err := ioutil.ReadFile("<path>")
       if err != nil {
           fmt.Println("failed to read CA certificate: %w", err)
           os.Exit(1)
       }
   
       caCertPool := x509.NewCertPool()
       if ok := caCertPool.AppendCertsFromPEM(caCert); !ok {
           fmt.Println("failed to append CA certificate")
       }
   
       client, err := opensearch.NewClient(opensearch.Config{
           Transport: &http.Transport{
           TLSClientConfig: &tls.Config{RootCAs: caCertPool},
           },
           Addresses: []string{
                               "https://<host_1>:<port>",
                               "https://<host_2>:<port>"
                           },
           Username:  "admin",
           Password:  "<password>",
       })
       if err != nil {
           fmt.Println("cannot initialize", err)
           os.Exit(1)
       } else {
           fmt.Println(client.Info())
       }
   }

   Specify:

   • <path> — full path to the root certificate; ;
   • <host_1> and <host_2> — node IP addresses; ;
   • <port> — connection port;;
   • <password> — user password.

Node.js

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Install dependencies:

   npm install @opensearch-project/opensearch

3. Use the connection example:

   import { readFileSync } from 'fs';
   import { Client } from '@opensearch-project/opensearch';
   
   const hosts = [
   "https://<host_1>:<port>",
   "https://<host_2>:<port>"
   ];
   
   const username = "admin";
   const password = "<password>";
   const caCertsPath = "<path>";
   
   const client = new Client({
   nodes: hosts,
   ssl: {
       ca: readFileSync(caCertsPath),
   },
   auth: {
       username,
       password
   }
   });
   
   const getClusterInfo = async () => {
   try {
       const response = await client.cluster.health();
       console.log('Cluster Info:', response.body);
   } catch (error) {
       console.error('Error fetching cluster info:', error);
   }
   };
   
   getClusterInfo();

   Specify:

   • <host_1> and <host_2> — node IP addresses; ;
   • <port> — connection port;;
   • <password> — administrator password; ;
   • <path> — full path to the root certificate.

Connect to a node in a group with the Dashboard role

OpenSearch Dashboards

You can connect to a node in a group with the Dashboard role via the OpenSearch Dashboards web interface.

1. Open the following page in your browser:

   https://<ip_address>

   Specify <ip_address> — IP address of the node in the group with the Dashboard role.

2. Enter username — admin.

3. Enter password — set when creating the cluster. Once created, the password cannot be viewed in the Control panel, but it can be changed.

4. To test the connection, in the Dev Tools console, run a test query — for example, check the cluster status:

   GET _cluster/health

   Cluster status information will appear in the response.

OpenSearch API

Connect to a node in a group with the Dashboard role and test the connection by running a test request — for example, check the cluster status:

curl -u 'admin:<password>' -X GET "https://<ip_address>/api/status"

Specify:

• <password> — set when creating the cluster. Once created, the password cannot be viewed in the Control panel, but it can be changed;
• <ip_address> — IP address of the node in the group with the Dashboard role.

Cluster status information will appear in the response.