Skip to content

OpenSearch Domains

Amazon OpenSearch Service (formerly Elasticsearch Service) is widely used for log analytics, full-text search, and application monitoring. However, OpenSearch domains can become a significant source of waste when left running without active workloads, especially multi-node clusters with memory-optimized instance types.

Implementation Effort: Medium - Estimated time: 2-4 hours. Verify no active search or indexing workloads, confirm no dependent applications or dashboards, take a snapshot, then delete or downsize the domain.

We identify idle OpenSearch domains through a detection algorithm that analyzes multiple signals over an extended observation period, including:

  • Search activity patterns
  • Indexing and write activity
  • Overall compute utilization across domain nodes

Only domains where all signals consistently indicate inactivity are flagged as unused, ensuring high-confidence results without false positives.

By surfacing truly idle domains, engineering and FinOps teams can make informed decisions to snapshot and delete, downsize, or consolidate OpenSearch domains that are not serving active workloads.