OpenSearch Dashboards (opensearch-dashboards)

Web console of OpenSearch: search, log exploration, visualisations, index and security administration. Stateless, its saved objects live in OpenSearch.

Generated from catalog/services/opensearch-dashboards.yaml: do not edit by hand.

Summary

Version	2.19.2
Use	install and configure
Layer	infrastructure (shown apart)
Category	Data platforms
Installation methods	binary, podman
External connection	no
Sandbox only	no

Licence

SPDX identifier	Apache-2.0
Licence policy	core licence (MIT or Apache-2.0)
Licence exception	-
Platform component	opensearch-dashboards

Packages and artifacts

A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.

Kind	Package	Version	Licence	Details
container image	docker.io/opensearchproject/opensearch-dashboards	2.19.2	Apache-2.0	image key opensearch-dashboards, used by account, dashboards, digest sha256:569b0ed262c231eac57fa9b582029e081c94e5663867191308eccca15118a1b4
binary archive	opensearch-dashboards-2.19.2-linux-x64.tar.gz	2.19.2	Apache-2.0	https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.19.2/opensearch-dashboards-2.19.2-linux-x64.tar.gz, x86_64, checksum sha256

Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.

Supported systems and architectures

Method	Operating systems	Architectures
binary	RHEL family (dnf), Debian family (apt), Arch Linux (pacman)	x86_64 (architecture of the artifacts of the descriptor)
podman	RHEL family (dnf), Debian family (apt), Arch Linux (pacman)	x86_64, aarch64 (not restricted by the descriptor)

Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.

Prerequisites

Host

• at least 1024 MB of memory (blocking, memory).

Programs the commands and checks of the service start on the host, outside the managed roots: add them to allowed_commands of the agent (see Security of the Navin agent), else the agent refuses them with command_not_allowed: /usr/bin/curl.

Network and ports

Component	Port name	Port	Opened in the host firewall
dashboards	web	5601/tcp	yes

Services and connections needed

• opensearch: opensearch.

Details and resolution: see Dependencies.

Installation methods and modes

Method	Default	What the method uses
binary	yes	the binary archives of the descriptor, unpacked under the service directory
podman	-	the container images of the descriptor, run by Podman under systemd

Components

Component	Kind	Installation methods	Ports
Service account setup (account)	one shot	binary, podman	-
Console server (dashboards)	master	binary, podman	5601/tcp

Single instance (single) (default)

One console server, enough for most installations.

What the mode deploys:

Component	Placement
account	min 1, max 1
dashboards	min 1, max 1

Replicated (replicated)

Several stateless servers behind the load balancer (HAProxy), sharing the session cookie key.

What the mode deploys:

Component	Placement
account	min 1, max 1
dashboards	min 2, recommended 2

Install this service

The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.

1. Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.

2. Choose the service. On the Service step, select OpenSearch Dashboards. The card shows the licence Apache-2.0 and the dependencies the installation needs. Pick the Method among binary, podman (default binary).

3. Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: single (default), replicated. Each mode deploys the components listed in Installation methods and modes. With several components, place each one on its hosts in Component placement (Suggest placement proposes a placement that respects the cardinalities).

4. Bind the dependencies. On the Bindings step, choose for each dependency (opensearch) Install with the platform or Use an existing connection; an optional dependency can stay on No binding.

5. Configure. On the Configure step, review the parameters (see Configuration parameters). Passwords left empty with a generated default are generated and sealed by the Manager.

6. Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.

7. Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.

High availability

Cluster	replicas (replication)
High availability	external (external)
Failover	load balancer (load-balancer)
Replication	shared store (shared-store)
Quorum	none (none)
Discovery	none (none)
Entry point	load balancer (load-balancer)
Official documentation	https://opensearch.org/docs/latest/install-and-configure/install-dashboards/index/
Peer TLS parameter	tls_enabled

Prerequisites

Prerequisite	Must be highly available	Modes	Description
opensearch	yes	modes of level ha or cluster	OpenSearch with its security plugin and TLS, itself highly available (cluster mode); it stores the saved objects.

Topology per mode

Modes	Highest catalog level	Distribution	Quorum component	Fault domains	Description
single	standalone (standalone)	single (single)	-	1	One console server, no fault tolerance.
replicated	ha (ha)	active-active (active-active)	-	2	Several stateless servers behind HAProxy sharing the cookie key; the saved objects live in OpenSearch.

Notes

• Multitenancy is disabled because the service account is not the server_username of the OpenSearch security plugin.

Configuration parameters

Network

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Web port (port)	port	5601	-	no	no	yes	Port of the web console and of /api/status.
TLS (tls_enabled)	bool	true	-	no	no	yes	Serve the console over TLS with a certificate issued by the manager CA (keep it on: the session cookie is then marked secure).

Security

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Service account (dashboards_username)	string	navin_dashboards	^[a-z][a-z0-9_]{2,40}$	no	no	no	Dedicated OpenSearch account of the console server (role kibana_server), created at install. Never the demo kibanaserver user. (advanced)
Service account password (dashboards_password)	password	generated	-	no	yes	no	Password of the service account, generated at every install and hashed by OpenSearch.
Session cookie key (cookie_password)	password	generated	-	no	yes	no	Key encrypting the session cookie of the users (32 characters, shared by the replicas).
Session lifetime (session_ttl_ms)	int	3600000	min 300000, max 86400000, ms	no	no	no	Lifetime of a user session without activity, in milliseconds (one hour by default).

Dependencies

For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).

Binding	Provided by	Connection type	Endpoint	Optional	When nothing is bound	Description
opensearch	opensearch	-	http	no	opensearch is added to the installation	OpenSearch cluster shown by the console, with its security plugin and TLS enabled.

Endpoints

Endpoint	Scheme	Component	Port	Path	TLS parameter	Binding parameters	Binding secrets	Provisioning command
web	http	dashboards	5601 (port)	-	tls_enabled	-	-	-

Commands

Command	Component	Target	Description
Console status (status)	dashboards	first host	Reads /api/status with the service account (overall state, plugins, OpenSearch connection).
Create the service account (create_account)	account	first host	Creates or updates the service account in OpenSearch with the current password (idempotent, after a password rotation for example).

Health checks

Liveness (per instance)

Component	Check	Details
dashboards	HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.port }}/api/status	Expected 200, 401; 90 retries; interval 2 s; timeout 5 s

Readiness (service check)

Check	Details
/usr/bin/curl -sS --fail -o /dev/null --netrc-file {{ paths.etc }}/dashboards.netrc --cacert {{ tls.ca_file }} {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.port }}/api/status	10 retries; interval 3 s; timeout 10 s

Preflight checks

Check	Type	Meaning	Severity	Components
memory	memory_mb {"min": 1024}	at least 1024 MB of memory	blocking	dashboards
web_port_free	port_free {"param": "port"}	port 5601 free on the host	blocking	dashboards

Uninstall

Paths removed when the data is purged: {{ paths.data }}, {{ paths.log }}.

Quick links

• OpenSearch Dashboards: {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.port }}/
• Status: {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.port }}/app/status

Upstream documentation

• Homepage: https://opensearch.org/docs/latest/dashboards/
• Source: https://github.com/opensearch-project/OpenSearch-Dashboards
• High availability: https://opensearch.org/docs/latest/install-and-configure/install-dashboards/index/