Download OpenSearch Data

Use this page when you need to export existing OpenSearch indices to local files. Elasticdump is an existing tool for moving OpenSearch data; it is not required to view logs. To recover older indices from Sauron backups, start with Restore OpenSearch Indices.

When should I use this?

Task Start here
Find and read logs Sending Logs
Export a known index to local files Follow the steps below.
Restore an older index from a Sauron snapshot Restore OpenSearch Indices
Export or restore many large indices Ask the Sauron team to review capacity and timing first.

Before you run Elasticdump

  1. Obtain an approved Elasticdump/Node.js version from your service owner; confirm multielasticdump --help works.
  2. Confirm the exact index name or pattern in OpenSearch Dashboards.
  3. Confirm you have an approved account with access to the source or target.
  4. Confirm your local disk has enough free space for the export.
  5. Use a working HTTPS certificate chain. If your environment uses a private CA, obtain the approved PEM bundle and set NODE_EXTRA_CA_CERTS to its file path before starting the Node.js process. Do not disable certificate verification.
  6. Set Elasticdump's ELASTICDUMP_INPUT_USERNAME and ELASTICDUMP_INPUT_PASSWORD from your approved secret source. Do not put the password in a URL, script, command argument, or log. For an upload, use ELASTICDUMP_OUTPUT_USERNAME and ELASTICDUMP_OUTPUT_PASSWORD instead.

Elasticdump documents these authentication environment variables. Node.js documents NODE_EXTRA_CA_CERTS.

Notes and recommendations

Start with one small index and check the output before exporting more. Large exports can take time and storage, and parallel jobs can increase load on OpenSearch. Keep the index pattern, start time, result, and output path for troubleshooting, with secrets removed.

Sample Script

Run a small export with this Sauron's configured API username. The password is entered at a prompt and is not placed in the URL. Run the examples in Bash. Replace the index pattern and output directory for your task.

#!/usr/bin/env bash
set -euo pipefail

export ELASTICDUMP_INPUT_USERNAME='sauron'
read -r -s -p 'OpenSearch password: ' ELASTICDUMP_INPUT_PASSWORD; echo
export ELASTICDUMP_INPUT_PASSWORD

mkdir -p ./opensearch-export
multielasticdump \
  --direction=dump \
  --input='https://elasticsearch.stage.apatil.developers.oracledx.com' \
  --output='./opensearch-export' \
  --match='^example-index-.*$' \
  --limit=1000 \
  --parallel=2
unset ELASTICDUMP_INPUT_PASSWORD

If certificate verification fails, confirm the hostname and CA bundle with your service owner. Do not retry with TLS verification disabled.

Prove it worked

  1. Confirm the command finished without child errors.
  2. Confirm files for the expected indices exist in the output directory.
  3. Spot-check the index names and a small sample of exported data.
  4. Keep the output in an approved location because log records may contain sensitive information.

Uploading Data to OpenSearch

Uploading can overwrite or create data. Confirm the target Sauron, index names, available capacity, and approved change window before running it. Use the approved target account. For this same Sauron, set the rendered username and enter its password before running the upload:

export ELASTICDUMP_OUTPUT_USERNAME='sauron'
read -r -s -p 'OpenSearch password: ' ELASTICDUMP_OUTPUT_PASSWORD; echo
export ELASTICDUMP_OUTPUT_PASSWORD

multielasticdump \
  --direction=load \
  --input='./opensearch-export' \
  --output='https://elasticsearch.stage.apatil.developers.oracledx.com' \
  --match='^example-index-.*$' \
  --limit=1000 \
  --parallel=2
unset ELASTICDUMP_OUTPUT_PASSWORD

Check the loaded indices and records in OpenSearch Dashboards before treating the upload as complete.

Tips and checks

  • Tips: Start with one small index. Keep exports in restricted storage because they may contain sensitive logs.
  • Check: Check command errors and compare document counts. Search for a known record after importing. If the command fails, check the index pattern, source and destination, output path, and certificate trust.