OpenSearch 運用・管理・インデックス設計 実践ガイド 2026

+------------------------------------------------------------------+
|                      クライアント / Data Prepper                    |
|                        (Ingest Pipeline)                          |
+------------------------------+-----------------------------------+
                               |
          +--------------------+--------------------+
          v                    v                    v
   +------------+       +------------+       +------------+
   | Master-1   |       | Master-2   |       | Master-3   |
   | (AZ-a)     |       | (AZ-b)     |       | (AZ-c)     |
   | 専用マスター |       | 専用マスター |       | 専用マスター |
   +------------+       +------------+       +------------+
          |                    |                    |
          v                    v                    v
   +------------+       +------------+       +------------+
   | Hot-1      |       | Hot-2      |       | Hot-3      |
   | (AZ-a)     |       | (AZ-b)     |       | (AZ-c)     |
   | EBS gp3    |       | EBS gp3    |       | EBS gp3    |
   +------------+       +------------+       +------------+
          |                    |                    |
          v                    v                    v
   +------------+       +------------+       +------------+
   | Warm-1     |       | Warm-2     |       | Warm-3     |
   | UltraWarm  |       | UltraWarm  |       | UltraWarm  |
   | (S3+キャッシュ) |   | (S3+キャッシュ) |   | (S3+キャッシュ) |
   +------------+       +------------+       +------------+

必要ストレージ = 日次原本データ
              × (1 + レプリカ数)
              × 1.1 (インデキシングオーバーヘッド)
              × 1.15 (OS予約 + 内部作業余裕)
              × 保存期間（日）

実際のプロビジョニング = 必要ストレージ / 0.75 = 10,120 GiB

プライマリシャード数 ≈ (原本データサイズ + 成長余裕) × 1.1 / 目標シャードサイズ

(66 + 198) × 1.1 / 30 ≈ 10 プライマリシャード

PUT _index_template/app-logs-template
{
  "index_patterns": ["app-logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 3,
      "number_of_replicas": 1,
      "refresh_interval": "30s",
      "index.translog.flush_threshold_size": "1024mb",
      "index.codec": "zstd_no_dict",
      "plugins.index_state_management.rollover_alias": "app-logs-write"
    },
    "mappings": {
      "dynamic": "strict",
      "properties": {
        "@timestamp":  { "type": "date" },
        "level":       { "type": "keyword" },
        "message":     { "type": "text", "analyzer": "standard" },
        "service":     { "type": "keyword" },
        "trace_id":    { "type": "keyword" },
        "span_id":     { "type": "keyword" },
        "host":        { "type": "keyword" },
        "duration_ms": { "type": "float" },
        "http_status": { "type": "short" },
        "request_path":{ "type": "keyword" },
        "user_id":     { "type": "keyword" },
        "metadata":    {
          "type": "object",
          "enabled": false
        }
      }
    }
  },
  "composed_of": ["common-settings"],
  "priority": 200
}

// インデキシング前：レプリカを無効化
PUT my-bulk-index/_settings
{ "index.number_of_replicas": 0 }

// インデキシング完了後：レプリカを復元
PUT my-bulk-index/_settings
{ "index.number_of_replicas": 1 }

PUT _plugins/_ism/policies/app-log-lifecycle
{
  "policy": {
    "description": "アプリログインデックスライフサイクル：hot → warm → cold → delete",
    "default_state": "hot",
    "states": [
      {
        "name": "hot",
        "actions": [
          {
            "rollover": {
              "min_size": "30gb",
              "min_index_age": "1d",
              "min_doc_count": 10000000
            }
          }
        ],
        "transitions": [
          { "state_name": "warm", "conditions": { "min_index_age": "3d" } }
        ]
      },
      {
        "name": "warm",
        "actions": [
          { "replica_count": { "number_of_replicas": 1 } },
          { "force_merge": { "max_num_segments": 1 } },
          { "allocation": {
              "require": { "temp": "warm" },
              "wait_for": true
            }
          }
        ],
        "transitions": [
          { "state_name": "cold", "conditions": { "min_index_age": "30d" } }
        ]
      },
      {
        "name": "cold",
        "actions": [
          { "replica_count": { "number_of_replicas": 0 } },
          { "read_only": {} }
        ],
        "transitions": [
          { "state_name": "delete", "conditions": { "min_index_age": "90d" } }
        ]
      },
      {
        "name": "delete",
        "actions": [
          {
            "notification": {
              "destination": {
                "slack": { "url": "https://hooks.slack.com/services/T.../B.../xxx" }
              },
              "message_template": {
                "source": "インデックス {{ctx.index}} が保持ポリシー（90日）に従い削除されます。"
              }
            }
          },
          { "delete": {} }
        ],
        "transitions": []
      }
    ],
    "ism_template": [
      { "index_patterns": ["app-logs-*"], "priority": 100 }
    ]
  }
}

# ポリシー実行状態の確認（特定インデックス）
GET _plugins/_ism/explain/app-logs-000001

# 既存インデックスにポリシーを適用
POST _plugins/_ism/add/old-logs-2025-*
{ "policy_id": "app-log-lifecycle" }

# ポリシーバージョンの更新（管理中のインデックスに新ポリシーを適用）
POST _plugins/_ism/change_policy/app-logs-*
{
  "policy_id": "app-log-lifecycle-v2",
  "state": "warm"
}

# 失敗したISM操作のリトライ
POST _plugins/_ism/retry/app-logs-000003

# 特定インデックスからISMポリシーを除去
POST _plugins/_ism/remove/app-logs-000005

// ステップ1：初期インデックス作成 + alias設定
PUT app-logs-000001
{
  "aliases": {
    "app-logs-write": { "is_write_index": true },
    "app-logs-read": {}
  }
}

// ステップ2：ISMポリシーのrolloverアクションが自動的に処理
//   → app-logs-000002を作成
//   → app-logs-write aliasを000002に移動
//   → 000001のis_write_indexをfalseに変更

// 読み取りは常にread aliasで（全履歴対象）
GET app-logs-read/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "level": "ERROR" } },
        { "range": { "@timestamp": { "gte": "now-1h" } } }
      ]
    }
  },
  "sort": [{ "@timestamp": "desc" }],
  "size": 100
}

// 書き込みは常にwrite aliasで
POST app-logs-write/_doc
{
  "@timestamp": "2026-03-04T10:00:00Z",
  "level": "ERROR",
  "service": "payment-api",
  "message": "決済ゲートウェイタイムアウト発生",
  "trace_id": "abc123",
  "duration_ms": 30500,
  "http_status": 504
}

# 現在のwrite indexを確認
GET _alias/app-logs-write

# 全alias構造を確認
GET _cat/aliases/app-logs-*?v&h=alias,index,is_write_index

# クラスタ全体の状態（green/yellow/red）
GET _cluster/health

# インデックス別の状態確認
GET _cluster/health?level=indices

# ノード別のJVM、CPU、ディスク詳細
GET _nodes/stats/jvm,os,fs

# ホットスレッドの確認（高CPU原因分析）
GET _nodes/hot_threads

# スレッドプール状態（待機、拒否数の確認）
GET _cat/thread_pool?v&h=node_name,name,active,queue,rejected

# シャード配置状況
GET _cat/shards?v&h=index,shard,prirep,state,docs,store,node&s=state

# 未割当シャードの原因分析
GET _cluster/allocation/explain
{
  "index": "app-logs-000003",
  "shard": 0,
  "primary": true
}

# インデックス別サイズとドキュメント数
GET _cat/indices?v&h=index,health,pri,rep,docs.count,store.size&s=store.size:desc

# ノード別ディスク使用量
GET _cat/allocation?v&h=node,shards,disk.used,disk.avail,disk.percent

# 保留中のタスクを確認
GET _cat/pending_tasks?v

PUT app-logs-*/_settings
{
  "index.search.slowlog.threshold.query.warn": "10s",
  "index.search.slowlog.threshold.query.info": "5s",
  "index.search.slowlog.threshold.fetch.warn": "5s",
  "index.indexing.slowlog.threshold.index.warn": "10s",
  "index.indexing.slowlog.threshold.index.info": "5s"
}

POST _plugins/_alerting/monitors
{
  "type": "monitor",
  "name": "Cluster Red Status Alert",
  "monitor_type": "query_level_monitor",
  "enabled": true,
  "schedule": {
    "period": { "interval": 1, "unit": "MINUTES" }
  },
  "inputs": [
    {
      "search": {
        "indices": [".opensearch-sap-log-types-config"],
        "query": {
          "size": 0,
          "query": {
            "match_all": {}
          }
        }
      }
    }
  ],
  "triggers": [
    {
      "query_level_trigger": {
        "name": "Cluster Status Red",
        "severity": "1",
        "condition": {
          "script": {
            "source": "ctx.results[0].hits.total.value >= 0",
            "lang": "painless"
          }
        },
        "actions": [
          {
            "name": "Notify Slack",
            "destination_id": "slack-destination-id",
            "message_template": {
              "source": "クラスタ状態がREDです。\nクラスタ：{{ctx.monitor.name}}\n時刻：{{ctx.periodEnd}}\n即座の確認が必要です。"
            },
            "throttle_enabled": true,
            "throttle": { "value": 10, "unit": "MINUTES" }
          }
        ]
      }
    }
  ]
}

# 1. 最も大きいインデックスを確認
GET _cat/indices?v&h=index,store.size&s=store.size:desc&format=json

# 2. 古い不要なインデックスを削除
DELETE old-logs-2024-*

# 3. read-onlyブロックを解除（全インデックス）
PUT _all/_settings
{
  "index.blocks.read_only_allow_delete": null
}

# 4. クラスタレベルのブロックを解除
PUT _cluster/settings
{
  "persistent": {
    "cluster.blocks.read_only": false
  }
}

# 5. クラスタ状態を確認
GET _cluster/health

// S3リポジトリ登録
PUT _snapshot/s3-backup
{
  "type": "s3",
  "settings": {
    "bucket": "my-opensearch-snapshots",
    "base_path": "daily",
    "region": "ap-northeast-2",
    "server_side_encryption": true,
    "role_arn": "arn:aws:iam::123456789012:role/OpenSearchSnapshotRole"
  }
}

// 手動スナップショット作成
PUT _snapshot/s3-backup/snapshot-2026-03-04
{
  "indices": "app-logs-*",
  "ignore_unavailable": true,
  "include_global_state": false
}

// スナップショット状態の確認
GET _snapshot/s3-backup/snapshot-2026-03-04/_status

// 特定インデックスのみ復元（名前変更で既存インデックスとの衝突を回避）
POST _snapshot/s3-backup/snapshot-2026-03-04/_restore
{
  "indices": "app-logs-000001,app-logs-000002",
  "ignore_unavailable": true,
  "include_global_state": false,
  "rename_pattern": "(.+)",
  "rename_replacement": "$1_restored",
  "index_settings": {
    "index.number_of_replicas": 0
  }
}

// 復元完了後にレプリカを復元
PUT app-logs-000001_restored/_settings
{ "index.number_of_replicas": 1 }

POST _reindex
{
  "source": {
    "remote": {
      "host": "https://old-es-cluster:9200",
      "username": "admin",
      "password": "********",
      "socket_timeout": "60m",
      "connect_timeout": "30s"
    },
    "index": "app-logs-2025-*",
    "size": 5000,
    "query": {
      "range": {
        "@timestamp": {
          "gte": "2025-01-01",
          "lt": "2026-01-01"
        }
      }
    }
  },
  "dest": {
    "index": "app-logs-migrated"
  },
  "conflicts": "proceed"
}

from opensearchpy import OpenSearch, helpers

client = OpenSearch(
    hosts=[{"host": "opensearch-node", "port": 9200}],
    http_auth=("admin", "admin"),
    use_ssl=True,
    verify_certs=False,
)

def generate_actions(file_path):
    """ログファイルを読んで_bulkアクションに変換"""
    import json
    with open(file_path) as f:
        for line in f:
            doc = json.loads(line)
            yield {
                "_index": "app-logs-write",
                "_source": doc,
            }

success, errors = helpers.bulk(
    client,
    generate_actions("/var/log/app/events.jsonl"),
    chunk_size=5000,
    max_retries=3,
    request_timeout=60,
)
print(f"Indexed: {success}, Errors: {len(errors)}")