Plugins by engine version in Amazon OpenSearch Service - Amazon OpenSearch Service
Optional pluginsThird party plugins

Plugins by engine version in Amazon OpenSearch Service

Amazon OpenSearch Service domains come prepackaged with plugins from the OpenSearch community. The service automatically deploys and manages plugins for you, but it deploys different plugins depending on the version of OpenSearch or legacy Elasticsearch OSS you choose for your domain.

The following table lists plugins by OpenSearch version, as well as compatible versions of legacy Elasticsearch OSS. It only includes plugins that you might interact with—it’s not comprehensive. OpenSearch Service uses additional plugins to enable core service functionality, such as the S3 Repository plugin for snapshots and the OpenSearch Performance Analyzer plugin for optimization and monitoring. For a complete list of all plugins running on your domain, make the following request:

GET _cat/plugins?v
Plugin Minimum required OpenSearch version Minimum required Elasticsearch version

HanLP

 2.11 Not supported

Hebrew Analysis

 2.11 Not supported

Amazon Personalize Search Ranking

 2.9 Not supported

Neural Search

 2.9 Not supported

Security Analytics

 2.5 Not supported

OpenSearch notifications

 2.3 Not supported

ML Commons

 1.3 Not supported

Sudachi Analysis (recommended for Japanese)

 1.3 Not supported

STConvert

 1.3 Not supported

Pinyin Analysis

 1.3 Not supported

Nori Analysis

 1.3 Not supported

OpenSearch observability

1.2

 Not supported

OpenSearch cross-cluster replication

 1.1 7.10

OpenSearch asynchronous search

 1.0 7.10

IK (Chinese) Analysis

 1.0 7.7

Vietnamese Analysis

Thai analysis

Learning to Rank

OpenSearch anomaly detection

 1.0 7.4

OpenSearch k-NN

 1.0 7.1

OpenSearch Index State Management

 1.0 6.8

OpenSearch security

 1.0 6.7

OpenSearch SQL

 1.0 6.5

OpenSearch alerting

 1.0 6.2

Ukrainian Analysis

 1.0 5.3

Mapper Size

 1.0 5.3

Mapper Murmur3

 1.0 5.1

Ingest User Agent Processor

 1.0 5.1

Ingest Attachment Processor

 1.0 5.1
Stempel Polish Analysis 1.0 5.1

Smart Chinese Analysis

 1.0 5.1

Seunjeon Korean Analysis

 1.0 5.1
Phonetic Analysis 1.0 2.3
Japanese (kuromoji) Analysis 1.0 Included on all domains

ICU Analysis

 1.0 Included on all domains

Optional plugins

In addition to the default plugins that come pre-installed, Amazon OpenSearch Service supports several optional language analyzer plugins. You can use the AWS Management Console and AWS CLI to associate a plugin to a domain, disassociate a plugin from a domain, and list all plugins. An optional plugin package is compatible with a specific OpenSearch version, and can only be associated to domains with that version.

Note that for the Sudachi plugin, when you reassociate a dictionary file, it doesn't immediately reflect on the domain. The dictionary refreshes when the next blue/green deployment runs on the domain as part of a configuration change or other update. Alternatively, you can create a new package with the updated data, create a new index using this new package, reindex the existing index to the new index, and then delete the old index. If you prefer to use the reindexing approach, use an index alias so that there's no disruption to your traffic.

Optional plugins use the ZIP-PLUGIN package type. For more information about optional plugins, see Custom packages for Amazon OpenSearch Service.

Third party plugins

Amazon OpenSearch Service now supports third party plugins from select partners. Like optional plugins, you can use the AWS Management Console and AWS CLI to associate a plugin to a domain, disassociate a plugin from a domain, and list all third party plugins in your domain. Third party plugin packages are compatible with specific OpenSearch versions, and can only be associated to domains with that OpenSearch version.

Third party plugins are owned and provided by a third-party developer. You are responsible for obtaining and maintaining valid licences directly from the third-party developers. These third party plugins are avilable in all AWS regions where Amazon OpenSearch Service is available except AWS GovCloud (US) Regions.

Note

Some plugin providers may not enable their plugins in all AWS regions where Amazon OpenSearch Service is available, please reach out to the plugin provider on questions related to availability of the plugin in your AWS region.

For more information about third party plugins, see Custom packages for Amazon OpenSearch Service.

The following third party plugins are now available on Amazon OpenSearch Service:

  • Portal26 Encrypted Search Plugin (Titanium-lockbox) : Portal26 encryption plugin from Portal26.ai uses NIST FIPS 140-2 certified encryption to encrypt data as its indexed by Amazon OpenSearch Service. This plugin includes a Bring Your Own Key (BYOK) capability, allowing you to setup separate encryption keys for each index.

  • Babel Street Match Plugin for OpenSearch (RNI): This plugin accurately matches names, organizations, addresses, and dates in over 24 languages, enhancing security operations and regulatory compliance while reducing false positives and increasing operational efficiency.

The following third party plugins are available for use with Amazon OpenSearch Service:

Plugin Name Third Party Provider Minimum required OpenSearch Service version Minimum required Elasticsearch version Requires a license
Titanium-lockbox Portal26.ai 2.15 Not supported Y

Name Match (RNI) OpenSearch plugin

 babelstreet.com 2.15 Not supported Y

The following Amazon OpenSearch Service features are unavailable for use when using third party plugins:

Plugin Name Encryption plugin Babel Street Match plugin

Cross cluster search

 Not supported Not supported

Cross cluster replication

 Not supported Not supported

Remote-reindex

 Not supported Not supported

Auto-tune

 Not supported Not supported

Ultrawarm

 Not supported Supported

Multi-AZ with Standby

 Not supported Not supported

You can use the "CreatePackage", "AssociatePackage" and "DissociatePackage" to upload and associate the plugin you use with your Amazon OpenSearch Service managed domain. "PACKAGE-CONFIG" and "PACKAGE-LICENSE" package types are supported for uploading the plugin configuration and license files. To obtain the license files to install Portal26, see Portal26.ai. To obtain the license files to install the Name Match (RNI) OpenSearch plugin, see Babel Street.

Prerequisites

  • Ensure that you have the plugin configuration and license files for theOpenSearch version running on your Amazon OpenSearch Service domain.

  • You must have the following enabled on your Amazon OpenSearch Service domain:

Installing third party plugins with AWS CLI

To enable use of third party plugins using the AWS CLI you will need to apply the following service model JSON:

  1. Fetch the list of available third party plugins using the describe-packages API.

    aws opensearch --region $REGION describe-packages --filters '[{"Name": "PackageType","Value": ["ZIP-PLUGIN"]}, {"Name": "PackageName","Value": ["<package-name>"]}]'

  2. Create a new package for plugin license using the existing CreatePackage API. 

    aws opensearch --region $REGION create-package --package-name <package-name> --package-type PACKAGE-LICENSE --package-source S3BucketName=<bucket>,S3Key=<key>

    Please update the bucket and key location to point to the license file in the account's s3 bucket. The file must have a .json or .xml extension.

  3. Create a new package for plugin config using the existing CreatePackage API. 

    aws opensearch --region $REGION create-package --package-name <package-name> --package-type PACKAGE-CONFIG --package-source S3BucketName=<bucket>,S3Key=<key
    Note

    Please update the bucket and key location to point to the config zip file in the calling account’s s3 bucket. The s3 must be in the same region where the package is created. Only zip files are supported for config type packages. The contents of the zip file must follow directory structure as expected by the plugin.

  4. Use the new AssociatePackage API to associate the partner plugin along with license and configuration with a compatible Amazon OpenSearch Service domain (matching version) using the package ids of these packages.

    aws opensearch --region $REGION associate-packages --domain-name <domain-name> --package-list '[{"PackageID": "<plugin-package-id>"},{"PackageID": "<license-package-id>","PrerequisitePackageIDList":["<plugin-package-id>"]},{"PackageID":"<config-package-id>","PrerequisitePackageIDList":["<plugin-package-id>"]}]'
    Note

    Plugins are installed and uninstalled using a blue/green deployment process.

  5. Use the existing ListPackagesForDomain API to see the status of the association. The association status will change as the workflow progresses from ASSOCATING to ACTIVE. The association status changes to ACTIVE once the plugin installation workflow has been completed and plugin is ready to be used.

    aws opensearch --region $REGION list-packages-for-domain --domain-name <domain name>

  6. Use the existing GetPackageVersionHistory API to see the versions for any package.

  7. License/config packages can be updated using the existing UpdatePackage API. Use the following API to apply package updates to a domain.

    aws opensearch --region $REGION update-package --package-id <package-id>  --package-source S3BucketName=<bucket>,S3Key=<key> --package-description <description>

  8. Use the existing DissociatePackage API to uninstall the plugin from any domain. You can use the existing ListPackagesForDomain API to see the status of the dissociation.

    aws opensearch --region $REGION dissociate-package --package-id <plugin-package-id> --domain-name <domain name>
    Note

    In order to uninstall a plugin, you will have first have to disable the plugin from every index before dissociating the plugin package.

  9. Use the existing ListPackagesForDomain API to see the status of the dissociation.