Connect to an OpenSearch cluster

To connect to an OpenSearch cluster, connect to nodes in a group with the Manager, Data, or Dashboard role. Choosing a node for connection depends on the purpose of your connection — for example, if you need access to the cluster dashboard, you should connect to a node from the group with the Dashboard role. For more information about node groups and their roles, see the Node Groups instruction.

You can:

• connect to nodes in a group with the Manager and Data roles — via code with SSL;
• connect to a node in a group with the Dashboard role — via the OpenSearch Dashboards web interface or OpenSearch API.

TLS(SSL) encryption is supported only when connecting via a private IP address.

When connecting, specify the port and address.

Connection ports

Use port 9200 to connect to cluster nodes.

Connection addresses

You can choose an address for connection depending on one of the scenarios:

• connecting to a cluster from a private subnet;
• connecting to a cluster from the internet.

You can view the connection address in the Control Panel.

Connecting to a cluster from a private subnet

If you are connecting to a cluster from a private subnet, use a private IP address.

To connect from another private subnet, first connect both private subnets to a cloud router.

Connecting to a cluster from the internet

If you are connecting to the cluster from the Internet, use a public IP address. The private subnet must meet the requirements. If the subnet does not meet the requirements, prepare it for a public IP address connection.

View connection address

1. In the Control Panel, click Products in the top menu and select Managed Databases.
2. Open the Active tab.
3. Open the database cluster page → Connection tab.
4. In the Connection addresses block, open the tab for the node group whose addresses you want to view.

Connect to nodes of a group with the Manager and Data roles

You can connect to nodes of groups with the Manager and Data roles using SSL only via a private IP address. Connecting using TLS(SSL) encryption ensures a secure connection between your server and the database cluster.

Bash

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Connect to the node:

   curl -XGET -u 'admin:<password>' --cacert ~/.opensearch/root.crt 'https://<ip_address>:<port>/'

   Specify:

   • <password> — administrator password; ;
   • <ip_address> — node IP address; ;
   • <port> — connection port.

Python

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Install the opensearch-py library:

   pip3 install opensearch-py

3. Connect to the node:

   from opensearchpy import OpenSearch
   
   hosts = ['<host_1>',
           '<host_2>']
   auth = ('admin', '<password>')
   ca_certs_path = '~/.opensearch/root.crt'
   
   client = OpenSearch(
       hosts,
       http_auth = auth,
       use_ssl = True,
       verify_certs = True,
       ssl_assert_hostname = False,
       ssl_show_warn = False,
       ca_certs = ca_certs_path
   )
   
   print(client.info())

   Specify:

   • <host_1> and <host_2> — node IP addresses; ;
   • <password> — administrator password.

Go

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Use the connection example:

   package main
   
   import (
       "crypto/tls"
       "crypto/x509"
       "fmt"
       "io/ioutil"
       "github.com/opensearch-project/opensearch-go"
       "net/http"
       "os"
   )
   
   func main() {
       caCert, err := ioutil.ReadFile("<path>")
       if err != nil {
           fmt.Println("failed to read CA certificate: %w", err)
           os.Exit(1)
       }
   
       caCertPool := x509.NewCertPool()
       if ok := caCertPool.AppendCertsFromPEM(caCert); !ok {
           fmt.Println("failed to append CA certificate")
       }
   
       client, err := opensearch.NewClient(opensearch.Config{
           Transport: &http.Transport{
           TLSClientConfig: &tls.Config{RootCAs: caCertPool},
           },
           Addresses: []string{
                               "https://<host_1>:<port>",
                               "https://<host_2>:<port>"
                           },
           Username:  "admin",
           Password:  "<password>",
       })
       if err != nil {
           fmt.Println("cannot initialize", err)
           os.Exit(1)
       } else {
           fmt.Println(client.Info())
       }
   }

   Specify:

   • <path> — full path to the root certificate; ;
   • <host_1> and <host_2> — node IP addresses; ;
   • <port> — connection port;;
   • <password> — user password.

Node.js

1. Download the root certificate and place it in the ~/.opensearch/:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Install dependencies:

   npm install @opensearch-project/opensearch

3. Use the connection example:

   import { readFileSync } from 'fs';
   import { Client } from '@opensearch-project/opensearch';
   
   const hosts = [
   "https://<host_1>:<port>",
   "https://<host_2>:<port>"
   ];
   
   const username = "admin";
   const password = "<password>";
   const caCertsPath = "<path>";
   
   const client = new Client({
   nodes: hosts,
   ssl: {
       ca: readFileSync(caCertsPath),
   },
   auth: {
       username,
       password
   }
   });
   
   const getClusterInfo = async () => {
   try {
       const response = await client.cluster.health();
       console.log('Cluster Info:', response.body);
   } catch (error) {
       console.error('Error fetching cluster info:', error);
   }
   };
   
   getClusterInfo();

   Specify:

   • <host_1> and <host_2> — node IP addresses; ;
   • <port> — connection port;;
   • <password> — administrator password; ;
   • <path> — full path to the root certificate.

Connect to a group node with the Dashboard role

OpenSearch Dashboards

You can connect to a group node with the Dashboard role through the OpenSearch Dashboards web interface.

1. Open the following page in your browser:

   https://<ip_address>

   Specify <ip_address> — IP address of a node in the group with the Dashboard role.

2. Enter the login — admin.

3. Enter the password — it is specified during cluster creation. Once created, the password cannot be viewed in the Control Panel, but it can be changed.

4. To verify the connection, run a test query in the Dev Tools console — for example, check the cluster status:

   GET _cluster/health

   The response will contain information about the cluster status.

OpenSearch API

Connect to a group node with the Dashboard role and verify the connection, run a test query — for example, check the cluster status:

curl -u 'admin:<password>' -X GET "https://<ip_address>/api/status"

Specify:

• <password> — specified during cluster creation. After creation, the password cannot be viewed in the Control Panel, but it can be changed;
• <ip_address> — IP address of a node in the group with the Dashboard role.

The response will contain information about the cluster status.