OpenSearch Serverless - some tips

opensearch_index_management.sh

# pip install awscurl
export COLLECTION_ID=j04odjdwa8f5xxxxxxxx
export OPENSEARCHHOST=`aws opensearchserverless batch-get-collection --ids ${COLLECTION_ID} | jq '.collectionDetails[] | .dashboardEndpoint'`

# Delete all indexes that follow a specific pattern
delete_old_indexes() {
  # TARGETDATE should look like YYYY.MM.DD where date is 1 month before now.
  export TARGETDATE=`date -d "-1 month" +"%Y.%m.%d"`
  export INDEXLIST=$(awscurl --service aoss  "${OPENSEARCHHOST}/_cat/indices" | grep ocsf | grep ${TARGETDATE} | awk '{print $1}')
  echo "${INDEXLIST}" | while read index; do awscurl --service aoss  -X DELETE "${OPENSEARCHHOST}/${index}"; done
}

create_new_index(){
  # create a new index
  awscurl -X PUT --service aoss  "${OPENSEARCHHOST}/ocsf-cuid-3005-cloudtrail-api_activity-2023.09.19" -H 'Content-Type: application/json' -d'
  {
    "settings": {
      "index": {
        "number_of_shards": 2,
        "number_of_replicas": 1
      }
    },
    "mappings": {
      "properties": {
        "age": {
          "type": "integer"
        }
      }
    },
    "aliases": {
      "sample-alias1": {}
    }
  }'

}