Connect to an OpenSearch cluster

To connect to an OpenSearch cluster, connect to nodes in a group with the Manager, Data, or Dashboard role. The choice of node to connect to depends on the purpose of the connection—for example, if you need access to the cluster dashboard, you must connect to a node from a group with the Dashboard role. More information about node groups and their roles is available in the Node Groups instruction.

You can:

• connect to nodes in a group with the Manager and Data roles — via code with SSL;
• connect to a node in a group with the Dashboard role — via the OpenSearch Dashboards web interface or OpenSearch API.

TLS(SSL) encryption is supported only when connecting via a private IP address.

When connecting, specify the port and address.

Connection ports

Use port 9200 to connect to cluster nodes.

Connection addresses

You can choose an address for connection depending on one of the scenarios:

• connecting to a cluster from a private subnet;
• connecting to a cluster from the internet.

You can view the connection address in the Control Panel.

Connecting to a cluster from a private subnet

If you are connecting to a cluster from a private subnet, use a private IP address.

To connect from another private subnet, first connect both private subnets to a cloud router.

Connecting to a cluster from the internet

If you are connecting to the cluster from the Internet, use a public IP address.

View connection address

1. In the Control panel, from the top menu, click Products and select Cloud Databases.
2. Open the Active tab.
3. Open the database cluster page → Connection tab.
4. In the Addresses for connection block, open the tab of the node group whose addresses you want to view.

Connect to nodes of a group with the Manager and Data roles

You can connect to nodes in a group with the Manager and Data role via SSL using only a private IP address. Connecting using TLS (SSL) encryption ensures a secure connection between your server and the database cluster.

Bash

1. Download the root certificate and place it in the ~/.opensearch/: folder:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Connect to the node:

   curl -XGET -u 'admin:<password>' --cacert ~/.opensearch/root.crt 'https://<ip_address>:<port>/'

   Specify:

   • <password> — password of the administrator user;
   • <ip_address> — node IP address;
   • <port> — connection port.

Python

1. Download the root certificate and place it in the ~/.opensearch/: folder:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Install the opensearch-py library:

   pip3 install opensearch-py

3. Connect to the node:

   from opensearchpy import OpenSearch
   
   hosts = ['<host_1>',
           '<host_2>']
   auth = ('admin', '<password>')
   ca_certs_path = '~/.opensearch/root.crt'
   
   client = OpenSearch(
       hosts,
       http_auth = auth,
       use_ssl = True,
       verify_certs = True,
       ssl_assert_hostname = False,
       ssl_show_warn = False,
       ca_certs = ca_certs_path
   )
   
   print(client.info())

   Specify:

   • <host_1> and <host_2> — node IP addresses;
   • <password> — password of the administrator user.

Go

1. Download the root certificate and place it in the ~/.opensearch/: folder:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Use the connection example:

   package main
   
   import (
       "crypto/tls"
       "crypto/x509"
       "fmt"
       "io/ioutil"
       "github.com/opensearch-project/opensearch-go"
       "net/http"
       "os"
   )
   
   func main() {
       caCert, err := ioutil.ReadFile("<path>")
       if err != nil {
           fmt.Println("failed to read CA certificate: %w", err)
           os.Exit(1)
       }
   
       caCertPool := x509.NewCertPool()
       if ok := caCertPool.AppendCertsFromPEM(caCert); !ok {
           fmt.Println("failed to append CA certificate")
       }
   
       client, err := opensearch.NewClient(opensearch.Config{
           Transport: &http.Transport{
           TLSClientConfig: &tls.Config{RootCAs: caCertPool},
           },
           Addresses: []string{
                               "https://<host_1>:<port>",
                               "https://<host_2>:<port>"
                           },
           Username:  "admin",
           Password:  "<password>",
       })
       if err != nil {
           fmt.Println("cannot initialize", err)
           os.Exit(1)
       } else {
           fmt.Println(client.Info())
       }
   }

   Specify:

   • <path> — full path to the root certificate;
   • <host_1> and <host_2> — node IP addresses;
   • <port> — connection port;
   • <password> — user password.

Node.js

1. Download the root certificate and place it in the ~/.opensearch/: folder:

   mkdir -p ~/.opensearch/
   wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
   chmod 0600 ~/.opensearch/root.crt

2. Install dependencies:

   npm install @opensearch-project/opensearch

3. Use the connection example:

   import { readFileSync } from 'fs';
   import { Client } from '@opensearch-project/opensearch';
   
   const hosts = [
   "https://<host_1>:<port>",
   "https://<host_2>:<port>"
   ];
   
   const username = "admin";
   const password = "<password>";
   const caCertsPath = "<path>";
   
   const client = new Client({
   nodes: hosts,
   ssl: {
       ca: readFileSync(caCertsPath),
   },
   auth: {
       username,
       password
   }
   });
   
   const getClusterInfo = async () => {
   try {
       const response = await client.cluster.health();
       console.log('Cluster Info:', response.body);
   } catch (error) {
       console.error('Error fetching cluster info:', error);
   }
   };
   
   getClusterInfo();

   Specify:

   • <host_1> and <host_2> — node IP addresses;
   • <port> — connection port;
   • <password> — password of the administrator user;
   • <path> — full path to the root certificate.

Connect to a group node with the Dashboard role

OpenSearch Dashboards

You can connect to a group node with the Dashboard role through the OpenSearch Dashboards web interface.

1. Open the following page in your browser:

   https://<ip_address>

   Specify <ip_address> — the IP address of the group node with the Dashboard role.

2. Enter the username — admin.

3. Enter the password — set when creating the cluster. After creation, the password cannot be viewed in the Control panel, but it can be changed.

4. To test the connection, in the Dev Tools console, run a test request — for example, check the cluster status:

   GET _cluster/health

   The response will contain information about the cluster status.

OpenSearch API

Connect to a group node with the Dashboard role and verify the connection, run a test query — for example, check the cluster status:

curl -u 'admin:<password>' -X GET "https://<ip_address>/api/status"

Specify:

• <password> — set when creating the cluster. After creation, the password cannot be viewed in the Control panel, but it can be changed;
• <ip_address> — the IP address of the group node with the Dashboard role.

The response will contain information about the cluster status.