16.4 OCI Search with OpenSearch & Resource Search for Observability

Two Kinds of Search

The exam's observability objective includes OCI Search, so know what both do and when to use each.

OCI Search with OpenSearch

OCI Search with OpenSearch is a managed service for building search solutions based on OpenSearch. It searches large data sets and returns results in milliseconds, while OCI handles security updates, upgrades, resizing, and scheduled backups. OpenSearch Dashboards provide visualization, so the service is often used for log and event analytics as well as application search.

Cluster Node Types

Every cluster has at least one data node, leader node, and Dashboards node. Stable leader nodes are important for cluster health, which is why production clusters use multiple leaders.

Networking and Access

• When you create a cluster, the service creates private endpoints in your VCN for the cluster API and for Dashboards, so all traffic stays inside the VCN.
• Security rules must allow TCP 9200 (OpenSearch API) and TCP 5601 (Dashboards) from the clients that need them.
• Administrators reach Dashboards from a laptop through OCI Bastion port forwarding or a jump host in the VCN. Applications in the VCN call port 9200 directly.
• Users who create clusters need networking permissions in the compartment that holds the VCN and subnet, plus permissions on the OpenSearch resources:

Allow group SearchOpenSearchAdmins to manage vnics in compartment network
Allow group SearchOpenSearchAdmins to manage vcns in compartment network
Allow group SearchOpenSearchAdmins to manage subnets in compartment network
Allow group SearchOpenSearchAdmins to use network-security-groups in compartment network
Allow group SearchOpenSearchAdmins to manage opensearch-family in compartment search

The opensearch-family aggregate covers opensearch-clusters, opensearch-cluster-backups, and opensearch-work-requests.

Patching, Resizing, and Backups

• Oracle schedules patching during the third week of each month, with occasional unscheduled patches when needed. During patching the cluster is read-only: searches work, but writes fail. The more shards and indices, the longer the window.
• The cluster is also read-only during horizontal resizes and most vertical resizes. The exception is increasing a data node's storage, which keeps the cluster writable.
• Backups are created automatically and can be restored.

Design ingestion so that writers can buffer and retry, for example by sending events to OCI Streaming first and indexing from the stream. A short read-only window then delays indexing without losing data.

Limits and Quotas

Default limits for universal credit tenancies are 10 data nodes, 3 leader nodes, and 3 Dashboards nodes per region. Administrators can set compartment quotas on the opensearch family, such as data-node-count.

Notifications Integration

OpenSearch clusters can send alerts to OCI Notifications topics when a policy lets the cluster principal use topics:

Allow any-user to manage ons-topics in tenancy where all {request.principal.type='opensearchcluster', request.resource.compartment.id='<compartment_ocid>'}

Where It Fits in an Observability Design

A common pattern sends logs through Connector Hub to Streaming, then into an OpenSearch ingestion pipeline that pulls from the stream and indexes events into the cluster.

Resource Search

Resource Search finds resources across a tenancy and selected regions. It also finds Console pages and documentation.

• Free-text search matches keywords across supported resource types and attributes.
• Structured queries use the Search query language:

query instance resources where lifeCycleState = 'RUNNING'
query all resources where timeCreated > now - 7d
query group, user resources where displayName = 'administrator'
query instance resources return allAdditionalFields

Key syntax rules:

• Queries start with query <resourceType> resources, and all searches every supported type. Individual resource types can be queried, but not family types.
• where conditions use = (case-insensitive equals), == (case-sensitive equals), !=, =~ (contains), and numeric or date comparisons. Combine them with &&, ||, or IN.
• matching 'text' searches all indexed fields, and sorted by <field> asc|desc orders results; the default order is newest first.
• union joins queries for different resource types that have different conditions.

IAM limits results. You see only the resources your policies allow you to inspect. Searching Console pages and documentation needs no permissions.

Using Resource Search for Operations

• Find terminated or stopped resources that still count against limits or cost money.
• List resources created in the last 24 hours after an incident.
• Check which resources match a naming or tagging standard before cleanup.
• Confirm that a backup exists before deleting a volume.