It's Not Just for Websites
When people hear "OpenSearch" (formerly Elasticsearch), they think of the search bar on an e-commerce site. While it does that well, its biggest use case in AWS is Log Analytics — the practice of collecting, storing, and querying massive volumes of machine-generated text to understand system behavior, detect security threats, and diagnose failures.
Companies dump terabytes of logs (CloudWatch, VPC Flow Logs, Application Logs) into OpenSearch every day to build dashboards and find errors. This creates two massive problems:
- Stability: High ingestion rates can overwhelm the cluster, causing it to become unresponsive or lose data.
- Cost: Storing 1 PB of logs on high-performance SSDs is extraordinarily expensive — often the largest line item in an infrastructure budget.
To solve both problems simultaneously, we move from a "Single Cluster" mentality to a Tiered Architecture — a design where different data gets stored on different hardware depending on how often it is accessed and how fast it needs to be retrieved.