Configuring a cold storage policy in Managed Service for OpenSearch

Written by

Updated at March 31, 2026

Getting started
- Required paid resources
Set up your infrastructure
Create a policy
Attach the policy to an index
Test the policy
Delete the resources you created

You can use policies to automate some operations with indexes. For example, to optimize the use of storage, you can set a policy that will move cold data to a specific host group and then repack that data using a codec with a higher compression ratio.

To configure such a policy:

If you no longer need the resources you created, delete them.

Getting started

Navigate to the management console and log in to Yandex Cloud or create a new account.
On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resources

Managed Service for OpenSearch cluster, which includes the use of computing resources and storage size (see Managed Service for OpenSearch pricing).
Public IP addresses (see Virtual Private Cloud pricing).

Set up your infrastructure

Prepare a Managed Service for OpenSearch cluster:
Manually

Using Terraform
1. Create a Managed Service for OpenSearch cluster in any suitable configuration with the following settings:
  - Two or more host groups with the DATA role. Give two groups the names hot and cold.
  - Public access to any host group.
2. If there are security groups in your cluster, make sure they allow connections to the Managed Service for OpenSearch.
1. If you do not have Terraform yet, install it.
2. Get the authentication credentials. You can add them to environment variables or specify them later in the provider configuration file.
3. Configure and initialize a provider. There is no need to create a provider configuration file manually, you can download it.
4. Place the configuration file in a separate working directory and specify the parameter values. If you did not add the authentication credentials to environment variables, specify them in the configuration file.
5. Download the opensearch-cold-storage-policy.tf configuration file to the same working directory. This file describes:
  - Network.
  - Subnets.
  - Security group and rules for connection to a Managed Service for OpenSearch cluster.
  - Managed Service for OpenSearch cluster.
6. In the opensearch-cold-storage-policy.tf file, specify the following variables:
  - version: OpenSearch version.
  - admin_password: OpenSearch admin password.
7. Validate your Terraform configuration files using this command:
  terraform validate
  Terraform will display any configuration errors detected in your files.
8. Create the required infrastructure:
  1. Run this command to view the planned changes:
    
    terraform plan
    
    If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
  2. If everything looks correct, apply the changes:
    
    Run this command:
    
    terraform apply
    
    Confirm updating the resources.
    
    Wait for the operation to complete.
  All the required resources will be created in the specified folder. You can check resource availability and their settings in the management console.
Install an SSL certificate.

Check the connection to the cluster using cURL:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --request GET 'https://<FQDN_of_OpenSearch_host_with_public_access>:9200/'

You can get the host FQDN with the list of hosts in the cluster.

If the connection is successful, you will see a message like this:

{
  "name" : "....mdb.yandexcloud.net",
  "cluster_name" : "...",
  "cluster_uuid" : "...",
  "version" : {
  "distribution" : "opensearch",
  ...
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

Create a policy

Create a policy that turns hot data to cold followed by archiving:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request PUT 'https://<OpenSearch_host_address_with_public_access>:9200/_plugins/_ism/policies/archive_policy' \
    --data '
        {
            "policy": {
                "description": "Example archive policy",
                "default_state": "hot",
                "schema_version": 1,
                "states": [
                    {
                        "name": "hot",
                        "actions": [
                            {
                                "allocation": {
                                    "require": { "groupname": "hot" }
                                }
                            }
                        ],
                        "transitions": [
                            {
                                "state_name": "cold",
                                "conditions": {
                                    "min_index_age": "1h"
                                }
                            }
                        ]
                    },
                    {
                        "name": "cold",
                        "actions": [
                            {
                                "allocation": {
                                    "require": { "groupname": "cold" }
                                }
                            }
                        ],
                        "transitions": [
                            {
                                "state_name": "archive",
                                "conditions": {
                                    "min_index_age": "2h"
                                }
                            }
                        ]
                    },
                    {
                        "name": "archive",
                        "actions": [
                            {
                                "repack": {
                                    "new_codec": "lzma"
                                }
                            }
                        ]
                    }
                ],
                "ism_template": {
                    "index_patterns": ["log*"],
                    "priority": 100
                }
            }
        }'

Where:

min_index_age: Index age that triggers creation of a new index. The recommended value is 30 days (30d).
index_patterns: Template for a new index name.
new_codec: Name of the codec to repack the data.

For a quick test of the policy, the request example has the following min_index_age settings:

For hot: 1 hour. After this time elapses, the data will turn cold.
For cold: 2 hours. After this time elapses, the data will be repacked by the lzma codec (archiving).

You can specify smaller values but not less than five minutes: this is the default time after which the policy conditions are checked again.

Attach the policy to an index

Create the log-000001 index:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request PUT 'https://<OpenSearch_host_address_with_public_access>:9200/log-000001?pretty' \
    --data '
        {
            "settings": {
                "index" : {
                    "routing" : {
                        "allocation" : {
                            "require" : {
                                "groupname" : "hot"
                            }
                        }
                    }
                }
            }
        }'

Check whether the policy is attached to the index:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_plugins/_ism/explain/log-000001?pretty'

You will get a message similar to the following:

{
  "log-000001" : {
    "index.plugins.index_state_management.policy_id" : "archive_policy",
    "index.opendistro.index_state_management.policy_id" : "archive_policy",
    "index" : "log-000001",
    "index_uuid" : "...",
    "policy_id" : "archive_policy",
    "enabled" : true
  },
  "total_managed_indices" : 1
}

Test the policy

Add a document to the index:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request POST 'https://<OpenSearch_host_address_with_public_access>:9200/log-000001/_doc?pretty' \
    --data '
        {
            "num": "101",
            "name": "Valya",
            "age": "25"
        }'

Get a list of index shards five minutes after the document is created:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/shards/log-000001?pretty'

The results will display the shards of the log-000001 index and the addresses of the hosts the shards reside on:

log-000001 0 r STARTED 1 5.2kb 10.2.0.35 rc1b-lgio8pjp********.mdb.yandexcloud.net
log-000001 0 p STARTED 1 5.2kb 10.1.0.4  rc1a-g36ksm4q********.mdb.yandexcloud.net

Make sure the shard is located in the host group named hot. To do this, get a list of hosts with these attributes:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/nodeattrs/?v&h=node,attr,value&pretty'

The results will contain the following lines:

node                                       attr       value
rc1b-lgio8pjp********.mdb.yandexcloud.net  groupname  hot
rc1a-g36ksm4q********.mdb.yandexcloud.net  groupname  hot
...

Get a list of shards for the log-000001 index again one hour after creating the index:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/shards/log-000001?pretty'

One hour is the policy condition for moving the index to the host group named cold.

The results will display the shards of the log-000001 index and the new addresses of the hosts the shards reside on:

log-000001 0 r STARTED 1 5.2kb 10.2.0.22 rc1b-is77nbdv********.mdb.yandexcloud.net
log-000001 0 p STARTED 1 5.2kb 10.1.0.25 rc1a-qocaisq1********.mdb.yandexcloud.net

Re-request a list of hosts with these attributes:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/nodeattrs/?v&h=node,attr,value&pretty'

The results will contain the following lines:

node                                       attr       value
rc1b-is77nbdv********.mdb.yandexcloud.net  groupname  cold
rc1a-qocaisq1********.mdb.yandexcloud.net  groupname  cold
...

Another hour later, get a list of shards for the log-000001 index again:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/shards/log-000001?pretty'

Two hours is the policy condition for applying the new codec (transfer to archive).

The results will display the shards of the log-000001 index and the addresses of the hosts the shards reside on:

log-000001 0 r STARTED 1 4.8kb 10.2.0.22 rc1b-is77nbdv********.mdb.yandexcloud.net
log-000001 0 p STARTED 1 4.8kb 10.1.0.25 rc1a-qocaisq1********.mdb.yandexcloud.net

The shards will now be smaller because the data was repacked by a new codec with a higher compression ratio.

Get the index settings and make sure the lzma codec is listed in them:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/log-000001/_settings?pretty'

Result:

{
  "log-000001" : {
    "settings" : {
      "index" : {
        ...
        "codec" : "lzma",
        "routing" : {
          "allocation" : {
            "require" : {
              "groupname" : "cold"
            }
          }
        },
        ...
      }
    }
  }
}

Delete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

Manually

Using Terraform

Delete the Managed Service for OpenSearch cluster.

In the terminal window, go to the directory containing the infrastructure plan.

Warning

Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.
Delete resources:
1. Run this command:
```
terraform destroy
```
2. Confirm deleting the resources and wait for the operation to complete.
All the resources described in the Terraform manifests will be deleted.

Configuring a cold storage policy in Managed Service for OpenSearch

Getting startedGetting started

Required paid resourcesRequired paid resources

Set up your infrastructureSet up your infrastructure

Create a policyCreate a policy

Attach the policy to an indexAttach the policy to an index

Test the policyTest the policy

Delete the resources you createdDelete the resources you created

Was the article helpful?