Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Configuring a cold storage policy in Yandex Managed Service for OpenSearch

Written by
Updated at March 31, 2026

You can use policies to automate some operations with indexes. For example, to optimize the use of storage, you can set a policy that will move cold data to a specific host group and then repack that data using a codec with a higher compression ratio.

To configure such a policy:

  1. Get your cloud ready.
  2. Set up your infrastructure.
  3. Create a policy.
  4. Attach the policy to an index.
  5. Test the policy.

If you no longer need the resources you created, delete them.

Getting started

Sign up for Yandex Cloud and create a billing account:

  1. Navigate to the management console and log in to Yandex Cloud or create a new account.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Set up your infrastructure

  1. Prepare a Managed Service for OpenSearch cluster:

    1. Create a Managed Service for OpenSearch cluster in any suitable configuration with the following settings:

      • Two or more host groups with the DATA role. Give two groups the names hot and cold.
      • Public access to any host group.

    2. If there are security groups in your cluster, make sure they allow connections to the Managed Service for OpenSearch.

    1. If you do not have Terraform yet, install it.

    2. Get the authentication credentials. You can add them to environment variables or specify them later in the provider configuration file.

    3. Configure and initialize a provider. There is no need to create a provider configuration file manually, you can download it.

    4. Place the configuration file in a separate working directory and specify the parameter values. If you did not add the authentication credentials to environment variables, specify them in the configuration file.

    5. Download the opensearch-cold-storage-policy.tf configuration file to the same working directory. This file describes:

      • Network.
      • Subnets.
      • Security group and rules for connection to a Managed Service for OpenSearch cluster.
      • Managed Service for OpenSearch cluster.

    6. In the opensearch-cold-storage-policy.tf file, specify the following variables:

      • version: OpenSearch version.
      • admin_password: OpenSearch admin password.

    7. Validate your Terraform configuration files using this command:

      terraform validate

      Terraform will display any configuration errors detected in your files.

    8. Create the required infrastructure:

      1. Run this command to view the planned changes:

        terraform plan

        If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

      2. If everything looks correct, apply the changes:

        1. Run this command:

          terraform apply

        2. Confirm updating the resources.

        3. Wait for the operation to complete.

      All the required resources will be created in the specified folder. You can check resource availability and their settings in the management console.

  2. Install an SSL certificate.

  3. Check the connection to the cluster using cURL:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --request GET 'https://<FQDN_of_OpenSearch_host_with_public_access>:9200/'

    You can get the host FQDN with the list of hosts in the cluster.

    If the connection is successful, you will see a message like this:

    {
  "name" : "....mdb.yandexcloud.net",
  "cluster_name" : "...",
  "cluster_uuid" : "...",
  "version" : {
  "distribution" : "opensearch",
  ...
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

Create a policy

Create a policy that turns hot data to cold followed by archiving:

curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request PUT 'https://<OpenSearch_host_address_with_public_access>:9200/_plugins/_ism/policies/archive_policy' \
    --data '
        {
            "policy": {
                "description": "Example archive policy",
                "default_state": "hot",
                "schema_version": 1,
                "states": [
                    {
                        "name": "hot",
                        "actions": [
                            {
                                "allocation": {
                                    "require": { "groupname": "hot" }
                                }
                            }
                        ],
                        "transitions": [
                            {
                                "state_name": "cold",
                                "conditions": {
                                    "min_index_age": "1h"
                                }
                            }
                        ]
                    },
                    {
                        "name": "cold",
                        "actions": [
                            {
                                "allocation": {
                                    "require": { "groupname": "cold" }
                                }
                            }
                        ],
                        "transitions": [
                            {
                                "state_name": "archive",
                                "conditions": {
                                    "min_index_age": "2h"
                                }
                            }
                        ]
                    },
                    {
                        "name": "archive",
                        "actions": [
                            {
                                "repack": {
                                    "new_codec": "lzma"
                                }
                            }
                        ]
                    }
                ],
                "ism_template": {
                    "index_patterns": ["log*"],
                    "priority": 100
                }
            }
        }'

Where:

  • min_index_age: Index age that triggers creation of a new index. The recommended value is 30 days (30d).
  • index_patterns: Template for a new index name.
  • new_codec: Name of the codec to repack the data.

For a quick test of the policy, the request example has the following min_index_age settings:

  • For hot: 1 hour. After this time elapses, the data will turn cold.
  • For cold: 2 hours. After this time elapses, the data will be repacked by the lzma codec (archiving).

You can specify smaller values but not less than five minutes: this is the default time after which the policy conditions are checked again.

Attach the policy to an index

  1. Create the log-000001 index:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request PUT 'https://<OpenSearch_host_address_with_public_access>:9200/log-000001?pretty' \
    --data '
        {
            "settings": {
                "index" : {
                    "routing" : {
                        "allocation" : {
                            "require" : {
                                "groupname" : "hot"
                            }
                        }
                    }
                }
            }
        }'

  2. Check whether the policy is attached to the index:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_plugins/_ism/explain/log-000001?pretty'

    You will get a message similar to the following:

    {
  "log-000001" : {
    "index.plugins.index_state_management.policy_id" : "archive_policy",
    "index.opendistro.index_state_management.policy_id" : "archive_policy",
    "index" : "log-000001",
    "index_uuid" : "...",
    "policy_id" : "archive_policy",
    "enabled" : true
  },
  "total_managed_indices" : 1
}

Test the policy

  1. Add a document to the index:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request POST 'https://<OpenSearch_host_address_with_public_access>:9200/log-000001/_doc?pretty' \
    --data '
        {
            "num": "101",
            "name": "Valya",
            "age": "25"
        }'

  2. Get a list of index shards five minutes after the document is created:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/shards/log-000001?pretty'

    The results will display the shards of the log-000001 index and the addresses of the hosts the shards reside on:

    log-000001 0 r STARTED 1 5.2kb 10.2.0.35 rc1b-lgio8pjp********.mdb.yandexcloud.net
log-000001 0 p STARTED 1 5.2kb 10.1.0.4  rc1a-g36ksm4q********.mdb.yandexcloud.net

  3. Make sure the shard is located in the host group named hot. To do this, get a list of hosts with these attributes:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/nodeattrs/?v&h=node,attr,value&pretty'

    The results will contain the following lines:

    node                                       attr       value
rc1b-lgio8pjp********.mdb.yandexcloud.net  groupname  hot
rc1a-g36ksm4q********.mdb.yandexcloud.net  groupname  hot
...

  4. Get a list of shards for the log-000001 index again one hour after creating the index:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/shards/log-000001?pretty'

    One hour is the policy condition for moving the index to the host group named cold.

    The results will display the shards of the log-000001 index and the new addresses of the hosts the shards reside on:

    log-000001 0 r STARTED 1 5.2kb 10.2.0.22 rc1b-is77nbdv********.mdb.yandexcloud.net
log-000001 0 p STARTED 1 5.2kb 10.1.0.25 rc1a-qocaisq1********.mdb.yandexcloud.net

  5. Re-request a list of hosts with these attributes:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/nodeattrs/?v&h=node,attr,value&pretty'

    The results will contain the following lines:

    node                                       attr       value
rc1b-is77nbdv********.mdb.yandexcloud.net  groupname  cold
rc1a-qocaisq1********.mdb.yandexcloud.net  groupname  cold
...

  6. Another hour later, get a list of shards for the log-000001 index again:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/_cat/shards/log-000001?pretty'

    Two hours is the policy condition for applying the new codec (transfer to archive).

    The results will display the shards of the log-000001 index and the addresses of the hosts the shards reside on:

    log-000001 0 r STARTED 1 4.8kb 10.2.0.22 rc1b-is77nbdv********.mdb.yandexcloud.net
log-000001 0 p STARTED 1 4.8kb 10.1.0.25 rc1a-qocaisq1********.mdb.yandexcloud.net

    The shards will now be smaller because the data was repacked by a new codec with a higher compression ratio.

  7. Get the index settings and make sure the lzma codec is listed in them:

    curl \
    --user admin:<password> \
    --cacert ~/.opensearch/root.crt \
    --header 'Content-Type: application/json' \
    --request GET 'https://<OpenSearch_host_address_with_public_access>:9200/log-000001/_settings?pretty'

    Result:

    {
  "log-000001" : {
    "settings" : {
      "index" : {
        ...
        "codec" : "lzma",
        "routing" : {
          "allocation" : {
            "require" : {
              "groupname" : "cold"
            }
          }
        },
        ...
      }
    }
  }
}

Delete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

  1. In the terminal window, go to the directory containing the infrastructure plan.

    Warning

    Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.

  2. Delete resources:

    1. Run this command:

      terraform destroy

    2. Confirm deleting the resources and wait for the operation to complete.

    All the resources described in the Terraform manifests will be deleted.

Previous
Configuring an index policy in Managed Service for OpenSearch
Next
Migrating data from a third-party OpenSearch cluster to Managed Service for OpenSearch using Data Transfer