OpenSearch is a distributed search and analytics engine forked from Elasticsearch 7.10.2 and Kibana 7.10.2 in 2021, after Elastic moved those projects off the Apache 2.0 licence. It kept the Apache 2.0 licence, and in 2024 the project moved to the OpenSearch Software Foundation under the Linux Foundation. The data model is the one engineers already know: JSON documents indexed into Lucene, an inverted index per analysed field, mappings that decide how each field is stored and searched, indices divided into primary and replica shards distributed across a cluster, and a JSON Query DSL with query and filter context plus a full aggregation framework.
What diverged is the plugin surface, and that divergence is the reason organisations choose OpenSearch. Capabilities that Elastic keeps under its own licence ship here as Apache-licensed plugins that are on by default. The Security plugin provides TLS, an internal user database, LDAP, Active Directory, SAML and OpenID Connect authentication, role-based access control, and fine-grained document-level and field-level security with field masking and audit logging. Index State Management replaces index lifecycle management, driving indices through hot, warm, cold and delete states by policy. Alerting with per-monitor triggers and notification channels, Anomaly Detection built on the Random Cut Forest algorithm, and Cross-Cluster Replication are all included.
The query surface is wider too: the same indices answer in SQL and in PPL, a piped language familiar from log platforms, as well as the Query DSL. OpenSearch Dashboards is the Kibana fork, carrying Observability, Query Workbench and Index Management. The k-NN plugin adds vector search across the Faiss, nmslib and Lucene engines, and ML Commons with Neural Search turns that into embedding-based and hybrid retrieval — which is why it so often sits behind retrieval-augmented generation.
Why this skill matters now
Licensing decided this one. When Elasticsearch moved to SSPL and the Elastic Licence, a large number of organisations discovered their search platform now carried terms their legal teams would not accept — cloud providers and ISVs most obviously, but also enterprises with redistribution obligations or open-source policies that permit Apache 2.0 and little else. OpenSearch exists because that constituency needed a supported path, and it has grown into a first-class engine rather than a snapshot.
The commercial arithmetic reinforces it. Security, alerting, index lifecycle policy and cross-cluster replication are all included at no cost, so the features that most often push an Elasticsearch deployment into a paid subscription are simply present. For a logging or security-analytics platform ingesting terabytes a day, that difference is a line item large enough to justify the migration on its own.
And then vector search changed the demand profile again. The k-NN plugin, ML Commons and Neural Search let the same cluster serve keyword relevance and semantic similarity, and hybrid queries that blend both, so OpenSearch is now a common retrieval layer under generative-AI applications. Teams need engineers who can size an HNSW index, choose between Faiss, nmslib and Lucene engines, and tune hybrid relevance — not only engineers who can write a match query.