The Storage Tiers: Hot, Warm, and Cold

To solve the cost problem, OpenSearch on AWS offers three distinct storage tiers. The core insight is simple: not all data has equal value at equal times. Yesterday's logs are queried constantly. Last year's logs are queried almost never. Charging the same storage price for both is wasteful.

1. Hot Tier (The Performance Zone)

• Storage: EBS (gp3 or io2) or fast NVMe Instance Store attached directly to the node.
• Role: Indexing new data and searching recent data (typically the last 7 days).
• Latency: Milliseconds — suitable for real-time dashboards and active troubleshooting.
• Cost: High. You are paying for fast, durable block storage attached to compute.

2. UltraWarm Tier (The Efficiency Zone)

• Storage: Amazon S3 as the durable backend, with local NVMe cache on the UltraWarm nodes.
• Role: Read-only data that is still queried regularly (e.g., logs 7–90 days old).
• Magic: Data lives on S3 (cheap, durable) but UltraWarm nodes cache hot blocks locally so queries return in seconds, not minutes.
• Cost: Approximately 90% cheaper than Hot tier for equivalent data volume.

3. Cold Tier (The Archive)

• Storage: Amazon S3, but the index is fully detached from the cluster.
• Role: Long-term retention for compliance or rare forensic access (e.g., logs older than 90 days).
• Behavior: You cannot search Cold data directly. You must explicitly "thaw" it — migrating it back to UltraWarm — before querying. This thaw operation takes minutes to hours depending on index size.
• Cost: Near-zero compute cost. You pay only S3 storage pricing.