OpenSearch

The OpenSearch tool gives a workbench read-only access to logs stored in an Amazon OpenSearch Service domain. The agent searches the configured index with text queries and can retrieve individual log entries or count log entries over time. Plural signs every request with AWS Signature Version 4, using either credentials available to the Console runtime or static access keys.

Prerequisites

Before you begin, make sure you have:

• An Amazon OpenSearch Service domain that is already indexing the logs you want the workbench to query.
• The domain endpoint, such as https://search-domain.us-east-1.es.amazonaws.com.
• The index name or pattern to query, such as logs-*.
• The AWS region of the domain, such as us-east-1.
• An AWS identity that can search the domain (see below).
• Permission in Plural Console to create a configured tool and edit the target workbench.
• An existing workbench, or permission to create one. See Setting up a workbench.

Choose how Plural authenticates

Plural supports two ways to obtain the AWS credentials it signs requests with:

• Pod identity or IRSA (recommended). Plural uses credentials already available to the Console runtime, such as EKS Pod Identity, IAM Roles for Service Accounts (IRSA), instance metadata, or another default AWS credential source. No keys are stored in the tool configuration.
• Static access keys. Create an IAM user for the integration and generate an access key ID and secret access key.

With either option, you can also set an IAM role for Plural to assume before it signs requests. Use this for cross-account access or to keep the OpenSearch permissions on a dedicated role. The base credentials must be allowed to assume that role, and the role's trust policy must allow them.

Grant read-only OpenSearch access

The tool sends signed POST /{index}/_search requests to the domain. Grant the IAM identity that signs requests, meaning the assumed role if you set one, permission to make that request: