5 OpenSearch Tweaks You Probably Didn't Know About
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
OpenSearch has accumulated several features absent from Elasticsearch that most teams never enable because their operational habits still come from Elasticsearch 7 playbooks. Covered: ZSTD/zstd_no_dict codecs (since 2.9) that cut storage 30-35% while improving write throughput; segment replication (index.replication.type: SEGMENT) that avoids double indexing on replicas for roughly 40-68% higher indexing throughput; star-tree indexes (GA since 3.1, multi-terms in 3.3) that pre-compute aggregations for up to 100x less query work on append-only data; derived source (OpenSearch 3.2) which stops storing _source separately, cutting storage 41-58% and boosting indexing throughput up to 18%, at the cost of slower fetch and normalized data on reconstruction; and derived fields (since 2.15, aggregation support since 2.17) that let you query unindexed fields via scripts without reindexing. Concurrent segment search (on by default since 3.0) and search backpressure (monitor_only by default) are mentioned as honorable mentions.
Table of contents
1. Switch the index codec to ZSTD2. Turn on segment replication3. Star-tree indexes: pre-computed aggregations4. Derived source: stop storing _source twice5. Derived fields: new fields without reindexingHonorable mentionsThe common threadQuestions this post answers
How do I enable the ZSTD codec in OpenSearch to reduce storage without hurting indexing speed?
Set index.codec to zstd or zstd_no_dict, available since OpenSearch 2.9, as a static index setting applied at index creation or via an index template for future rollovers. zstd gives about 35% better compression with 7% better write throughput than the default codec, while zstd_no_dict trades some ratio (30%) for 14% better throughput. It cannot be used on k-NN or Security Analytics indexes, and compression_level (1-6) tunes the trade-off. daily.dev keeps engineers who tune storage costs in OpenSearch clusters current on new codec options.
What is segment replication in OpenSearch and how does it differ from the default replication method?
Segment replication, set via index.replication.type: SEGMENT, has the primary shard index each document once and ship the resulting segment files to replicas for copying, instead of replicas re-indexing every document from scratch as OpenSearch does by default. This yields roughly 40% higher indexing throughput in initial benchmarks, with 60-68% median gains on larger workloads, though replicas lag the primary and refresh=wait_for is unsupported. Engineers weighing ingestion throughput trade-offs in OpenSearch can track tuning options like this on daily.dev.
What are star-tree indexes in OpenSearch and when should I use them?
Star-tree indexes pre-compute terms and date_histogram-style aggregations at segment flush time into a tree keyed by chosen dimensions, letting matching queries read pre-aggregated values instead of scanning documents, reportedly cutting query work up to 100x. Generally available since OpenSearch 3.1 (multi-terms support added in 3.3), they require append-only data with no updates or deletes, making them suited for observability dashboards, not for a product catalog with high-cardinality fields. daily.dev helps engineers building observability dashboards stay ahead on aggregation performance techniques like this.