OpenSearch Cold Storage Using S3 Bucket

Juan Romero

23-May-2025

OpenSearch Cold Storage Using S3 Bucket

Install OpenSearch S3 Plugin

Install OpenSearch S3 Plugin (if cluster, install in all nodes). This is required only if the plugin wasn't installed previously:

NOTE: For Wazuh Indexer package use the command below. For OpenSearch package, use “/usr/share/opensearch/bin/opensearch-plugin”. Other file locations referenced later in this article will also be different depending on the Indexer packa used (Wazuh Indexer or OpenSearch).

#/usr/share/wazuh-indexer/bin/opensearch-plugin install repository-s3

Verify KeyStore permissions after plugin install and ensure R/W permissions exist for all groups:

-rw-rw-rw- 1 root root 324 Sep 25 00:08 /etc/wazuh-indexer/opensearch.keystore

Edit /etc/wazuh-indexer/opensearch.yml and add default S3 bucket info:

### Wasabi S3 Bucket

s3.client.default.endpoint: s3.us-east-2.wasabisys.com

s3.client.default.region: us-east-2

(Modify according to region where the bucket was provisioned)

Add S3 access key and secret:

./bin/opensearch-keystore add s3.client.default.access_key

./bin/opensearch-keystore add s3.client.default.secret_key

Each command will prompt for the creds (accessjkey and secret)
that  were created and assigned with the right permissions to the S3 bucket.

NOTE: The account created should have the following permissions:

"s3:ListBucket",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"

Restart the Wazuh Indexer / OpenSearch service.

Configure a new Repository using Wazuh Dashboard

Logon to the Wazuh UI, from the left panel, Indexer Management – Snspshot Management:

Create a new repository:

Create:

Select custom repository and add S3 bucket settings:

{

    "type": "s3",

    "settings": {

        "bucket": "<bucket_name>",

        "base_path": "<bucket_base_path>"

    }

}

Change bucket name

Base Path = path within the bucket to store the snapshots

Create snapshot policy and scheduler

Guidelines:

• Define the scheduler according to the hot retention period:
  • Example: If your hot data is available for 60 days, define the scheduler to run once every two months and backup all indices in the index set. If an index set is named “fortinet-companyA” then select the index using the wildcard: fortinet-companyA_*).
    • Different clients and different log sources can have assigned different hot data retention strategies. Always align the snapshot scheduler with the hot data period of the index set to be backed up.
  • Before restoring any index from a snapshot, ensure that the restored index will be created using a prefix. Example: “restore_fortinet-companyA_10”

Assign policy name and description:

Select / type indices to be stored and the repository (S3 bucket base path) where the indices will be stored:

Define the snapshot schedule:

Define retention period:

Create the new policy:

Verify policy creation: