Managed OpenSearch on AWS
Managed OpenSearch® by Selfhost.dev, search and vectors, run for you.
Selfhost.dev runs dedicated OpenSearch clusters on AWS for app search, log analytics and vector search. HTTPS on every request, k-NN built into the engine, OpenSearch Dashboards when you want them and snapshots you can restore or fork. Start on one node or run a real cluster with dedicated manager nodes, priced machine by machine before you create it.
The reliable home for your data.
Dedicated PostgreSQL, MySQL, Redis, ClickHouse, OpenSearch and Kafka on AWS, with BYOC into your own account. Multi-AZ on all six, PITR on Postgres and MySQL.
In our AWS account or your own with BYOC. You get AWS uptime and performance; we handle the ops.
Try it
Type a query.
Watch it rank.
Keyword search finds the words you typed. Vector search finds what you meant. Try keep my tea hot in both modes and watch the flask turn up without a single shared word.
- Drinkware
- Coffee
- Running
- Camping
- Audio
How the index is defined
PUT /products
{
"settings": { "index.knn": true },
"mappings": {
"properties": {
"title": { "type": "text" },
"description": { "type": "text" },
"category": { "type": "keyword" },
"price": { "type": "float" },
"embedding": { "type": "knn_vector", "dimension": 2 }
}
}
}Runs in your browser on 20 sample documents. Keyword mode scores with BM25 the way OpenSearch does. Vector mode uses a 2-dimension stand-in so it can be drawn. Your embedding model outputs hundreds of dimensions; set dimension in the mapping to match it. The request panel is the query DSL you would send.
Price it before you create it
One node or a real cluster.
Every machine on the bill.
High availability in OpenSearch is its own shape: data nodes plus three dedicated manager nodes that hold the quorum, so the smallest HA cluster is five machines, not two. The sizer prices each one with live AWS rates, the way the console does before you create anything.
1 machine
What you get
The whole cluster, managed.
Nothing hidden behind it.
OpenSearch 3.8 or 2.19
Pick the current 3.x line or 2.19 at create. The cluster comes up with the security plugin on, so every request needs a user.
HTTPS on every request
Port 9200 speaks TLS only. There is no plaintext listener to leave open by mistake.
Users with roles
Create users as read-only, read-write or admin. Each maps onto an OpenSearch security role, so every app gets only the access it needs.
Vector search, built in
The k-NN plugin ships inside the engine. Map a knn_vector field and query it; there is no extension to enable.
OpenSearch Dashboards, one switch
Turn Dashboards on at create or later and off again whenever you like. It gets its own HTTPS address, runs beside the cluster and never touches cluster health. It needs 4 GB of RAM; 8 GB is recommended.
High availability as a real cluster
Multi-AZ runs two or more data nodes plus three dedicated manager nodes across availability zones, so the cluster keeps its quorum when a node fails. You choose the shape at create.
Snapshots, restore and fork
Take snapshots on demand or on a backup policy, restore the cluster from one or fork an independent copy to test against.
Resize without losing data
A size change drains each node before it is replaced, so shards move off first and nothing is dropped. Autoscaling rules can make the change for you as load moves.
Cluster health you can read
Live metrics for cluster status, shards, JVM heap, CPU, disk and search and indexing rates, with email and Slack alert rules on any of them.
Logs and query stats
Engine, restore, fork and replication logs in the console, plus search and indexing rates, shard health and index and document counts.
Locked down by default
IP allow-lists, delete protection and public access only if you turn it on. Data at rest is encrypted on EBS.
Manage it from your AI editor
The Selfhost.dev MCP server creates OpenSearch clusters, prices every node first and manages users from Claude, Cursor or any MCP client.
Connect in a minute
A REST API over HTTPS.
No client to install.
Copy the endpoint and a user from the console's Connection tab. curl prompts for the password, so it never lands in your shell history. The same request works from any OpenSearch client.
Why the -k
Each cluster signs its own certificate; that authority is not downloadable yet. Start with verification relaxed, as below, then connect from inside your VPC for production traffic.
# cluster health: green, yellow or red
curl -k -u YOUR_USER "https://YOUR_ENDPOINT:9200/_cluster/health?pretty"
# list the indices and their document counts
curl -k -u YOUR_USER "https://YOUR_ENDPOINT:9200/_cat/indices?v"# pip install opensearch-py
import os
from opensearchpy import OpenSearch
client = OpenSearch(
hosts=[{"host": "YOUR_ENDPOINT", "port": 9200}],
http_auth=("YOUR_USER", os.environ["OPENSEARCH_PASSWORD"]),
use_ssl=True,
verify_certs=False, # the cluster CA is not downloadable yet
)
print(client.cluster.health())// npm install @opensearch-project/opensearch
const { Client } = require('@opensearch-project/opensearch');
const client = new Client({
node: 'https://YOUR_ENDPOINT:9200',
auth: { username: 'YOUR_USER', password: process.env.OPENSEARCH_PASSWORD },
ssl: { rejectUnauthorized: false }, // the cluster CA is not downloadable yet
});
const { body } = await client.cluster.health();
console.log(body.status);
Your data: encrypted, isolated,
and always under your control.
Security is not a separate tier here. Every managed instance ships locked down by default, encrypted end to end and yours to export or run in your own cloud.
See how we secure and run your dataEncrypted in transit and at rest
TLS on the wire, AWS KMS on disk. Snapshots and backups are encrypted too.
Single-tenant, dedicated instance
Your own dedicated instance, not a shared multi-tenant database pool.
Private by default
IP whitelisting and delete protection are on. Public access only if you turn it on.
Multi-AZ, PITR and backups
Automatic failover on every engine, point-in-time restore on PostgreSQL and MySQL, automated backups on all.
Your data stays yours (BYOC)
Run it in your own AWS account. Standard engines, nothing proprietary, yours to keep.
Where it fits
When a LIKE '%query%' stops cutting it.
App and site search
Relevance-ranked full-text search with fuzzy matching, highlighting and filters, behind your own API.
Log and event analytics
Send logs and events in, then search, aggregate and chart them in OpenSearch Dashboards without running the stack yourself.
Vector search and RAG
Keep embeddings next to the text they came from and retrieve by meaning with k-NN, for RAG, recommendations and semantic search.
Catalogs and facets
Aggregations turn one result set into facet counts, price ranges and filters in the same request.
OpenSearch is a search and analytics engine, not your system of record. Keep the app's writes in managed PostgreSQL or MySQL on the same account and index what people need to find.
Before you start
Five things we would
want to know first.
None of these are surprises you should meet after the first invoice or the first outage, so here they are up front.
- 1 High availability is chosen at create. A single node cannot become a cluster later and a cluster cannot drop back to one node.
- 2 There is no point-in-time recovery. Snapshots and restores are whole-cluster; there is no index-level restore.
- 3 Engine settings are not tunable from the console and there is no connection pooling; clients talk HTTP to one endpoint.
- 4 The cluster certificate authority is not downloadable yet, so clients start with verification relaxed or connect from inside your VPC.
- 5 Query stats show rates and shard health, not individual slow queries: that needs the OpenSearch slow log, which is off.
One platform
Search next to
the rest of your stack.
Run OpenSearch beside PostgreSQL, MySQL, Redis and ClickHouse on one account with one pay-as-you-go bill, with your apps on Projects. Keep it in our AWS account or in yours with BYOC; either way we run the provisioning, backups, failover and resizing.
- ✓ Dedicated EC2 machines you size yourself, no shared cluster
- ✓ Billed by the hour from prepaid credits, stopped at a zero balance
- ✓ BYOC into your own AWS account, no enterprise contract
OpenSearch needs 4 GB of RAM, so single nodes start at a 4 GB instance. A public IPv4 (about $5/mo) comes with every machine. Price your cluster.
Frequently asked questions
What is Selfhost.dev managed OpenSearch?
How does high availability work?
How much does managed OpenSearch cost?
Does it include vector search?
Can I use OpenSearch Dashboards?
How do I connect?
How are backups handled?
Which OpenSearch versions are supported?
Can I run it in my own AWS account?
I need Elasticsearch, not OpenSearch. Is there an option?
Search and vectors, run for you.
Priced before you press create.
$5 in free credit to start, no card needed.