Elasticsearch vs. OpenSearch: key differences (2026)

Elasticsearch and OpenSearch are two open-source search engines built from the same original codebase, and the split between them now shapes licensing costs, query performance, and AI features for search and analytics teams. Elasticsearch and OpenSearch shared code under Apache 2.0 until early 2021, and five years of separate development have turned one search engine into two different products.

This guide compares them on licensing, governance, benchmarked performance, vector search, machine learning, and costs as of 2026, drawing on Elastic’s 2024 AGPLv3 change and published benchmarks from Elastic, Trail of Bits, and BigData Boutique.

Origins: why did Amazon fork Elasticsearch?

Amazon forked Elasticsearch because Elastic’s 2021 licensing change closed off the Apache 2.0 version AWS had been building its managed service on. AWS launched Open Distro in 2019 as an Apache 2.0 distribution that bundled the security, alerting, and SQL plugins Elastic kept for commercial tiers. Elastic viewed AWS’s managed Elasticsearch offering as a competing commercial product built on its open-source work, and in January 2021 it announced a licensing change to prevent that reuse. Elasticsearch and Kibana would move at 7.11 from Apache 2.0 to dual Server Side Public License (SSPL) and Elastic License 2.0 terms, and 7.10 became the last Apache 2.0 release.

With the Apache 2.0 source no longer available for new versions, AWS created the OpenSearch fork from Elasticsearch 7.10.2 and Kibana 7.10.2 to preserve a permissively licensed distribution it could keep shipping. It reached 1.0 general availability (GA) in July 2021 and absorbed Open Distro. AWS completed the Linux Foundation transfer on September 16, 2024, and governance moved to the OpenSearch Software Foundation. Both projects remain active. Elasticsearch 9.5.2 released on August 20, 2026, and OpenSearch 3.8.0 released on August 4, 2026, on a roughly eight-week cycle.

Licensing and governance

OpenSearch is licensed strictly under Apache 2.0, with security, alerting, and SQL alongside anomaly detection in the free distribution. Elasticsearch used Apache 2.0 through 7.10, then SSPL and Elastic License 2.0 from 2021. It added a third licensing option, the GNU Affero General Public License v3 (AGPLv3), from version 8.16.0 on August 29, 2024.

AGPLv3 covers only the “free portions” of the source code; Elastic subscriptions remain required for advanced management, security, and machine learning features.

What is X-Pack, and does OpenSearch have it?

X-Pack became one subscription in 2017 for security, monitoring, alerting, and reporting. Elastic made it source-inspectable in 2018 under the Elastic License, which is not an open-source license. OpenSearch uses native plugins derived from Open Distro’s Apache 2.0 equivalents for security, alerting, SQL, and anomaly detection instead of X-Pack.

OpenSearch provides free counterparts for security, alerting, SQL, and anomaly detection. OpenSearch also provides free, open-source analytics counterparts and OpenSearch Assistant, although they differ from Elastic’s data frame analytics and Elastic’s AI Assistant. Their implementations and configuration surfaces differ.

Performance: which is faster, Elasticsearch or OpenSearch?

The benchmark record is contradictory. Elastic’s tests put Elasticsearch ahead, while the independent Trail of Bits test, commissioned by AWS, found OpenSearch ahead overall on mixed workloads and Elasticsearch ahead on text queries.

The tests measured filtered vector search and the mixed Big5 workload. Core log analytics was also measured, but the tests used different engine versions, so the rows are not directly comparable.

Benchmark	Engines Tested	Finding
Elastic, February 2026 (vendor-published)	Elasticsearch 9.3.0 vs. OpenSearch 3.5.0, both on Lucene 10.3.2	Elasticsearch up to 8x faster on filtered vector search
Trail of Bits, March 2025 (independent, commissioned by AWS)	OpenSearch 2.17.1 vs. Elasticsearch 8.15.4	OpenSearch 1.56x faster overall on the Big5 workload; Elasticsearch 2.42x faster on text queries; OpenSearch 16.55x faster on date histograms
BigData Boutique, April 2026 (independent)	Elasticsearch 9.3.3 vs. OpenSearch 3.6	Core search and log analytics remain comparable

OpenSearch’s historical Lucene-version disadvantage has narrowed. Both engines are on Lucene 10 (10.3.2 in the February 2026 head-to-head), and Elastic’s February 2026 write-up conceded that “the throughput and latency differences we observe cannot be attributed to Lucene alone.”

Elastic’s performance claims report 40 to 140 percent faster querying. At smaller scale and on log-analytics workloads, practical differences may be negligible.

Core feature differences

Both engines shipped breaking changes in 2025 with Elasticsearch 9.0 and OpenSearch 3.0. The two products diverge most in the query layer and in machine learning. Elastic invested in ES|QL while OpenSearch invested in PPL, so teams switching engines often face query tooling rewrites. Machine learning capabilities that ship free in OpenSearch often sit behind a paid Elastic subscription, which affects budget more than engineering effort.

Query languages

Elasticsearch pairs its Query DSL (domain-specific language) with ES|QL, GA since 8.14, a pipe-based language that gained LOOKUP JOIN in 8.19/9.1.

OpenSearch’s Query DSL stays backward compatible with the Elasticsearch 7.10 REST API and adds SQL and PPL through a plugin, which gained joins, subsearches, and an Apache Calcite engine in 3.3. ES|QL has no OpenSearch equivalent, so ES|QL queries must be rewritten in PPL or Query DSL.

Machine learning and anomaly detection

Elasticsearch gates anomaly detection, data frame analytics, production PyTorch model import, and the Elastic AI Assistant behind Platinum or Enterprise subscriptions; its free tier keeps log-rate spike analysis, pattern analysis, and vector search.

OpenSearch ships time-series anomaly detection (Random Cut Forest), alerting, and free ML Commons capabilities for model serving and remote model connectors under Apache 2.0. If you already pay for Platinum, the split is a line item; if you self-host, it decides the engine.

Kibana vs. OpenSearch Dashboards

Kibana is under Elastic’s licenses, with sub-feature privileges and PDF/PNG reporting on paid tiers. OpenSearch Dashboards is the Apache 2.0 fork of Kibana 7.10.2. Plugins built for Elasticsearch JARs need changes for OpenSearch JARs.

Vector search and AI capabilities

Elastic’s vector benchmark claims up to 12x faster vector search, based on Elasticsearch 8.14 against OpenSearch 2.14. The independent Trail of Bits test found OpenSearch’s NMSLIB and Faiss engines modestly faster than Elasticsearch’s Lucene engine, with OpenSearch’s Lucene engine 258 percent slower.

The products also differ in supported backends, dimension ceilings, and access to free agent tooling. Elasticsearch vector search and OpenSearch vector search both run production workloads, so the choice turns on required capabilities and pricing.

Capability	Elasticsearch	OpenSearch
Max float vector dimensions	4,096	16,000
k-nearest neighbor backends	Lucene Hierarchical Navigable Small World (HNSW) only	Faiss (HNSW and inverted file, IVF) and Lucene HNSW; NMSLIB removed in 3.0
Retrieval-augmented generation (RAG)	Retriever framework native to _search	Neural search plugin plus ML Commons RAG pipeline
Agentic AI	Agent Builder, GA January 2026, paid	Plan-execute-reflect agents GA in 3.2, free; Model Context Protocol (MCP) support GA in 3.3 to 3.4, free

Both engines can run a full retrieval-augmented generation flow end to end. Elasticsearch retrieval chains embedding, k-NN retrieval, reciprocal rank fusion, and reranking in a single _search call, and OpenSearch retrieval pipelines cover the same steps through neural search and ML Commons.

On logging and observability workloads the two are roughly equivalent, with OpenSearch shipping more free features. Coralogix takes a different approach for log data, using in-stream processing rather than an index-first architecture, which changes the cost and retention calculus for log management.

Security features: free vs. paid

The OpenSearch security plugin is free under Apache 2.0: transport layer security (TLS), role-based access control (RBAC), field-level security, and audit logging. Elasticsearch’s free Basic tier covers TLS, RBAC, file and native authentication, audit logging, and IP filtering.

Platinum and Enterprise hold single sign-on (SSO), Lightweight Directory Access Protocol (LDAP) and Active Directory integration, field- and document-level security, and Elastic Security’s security information and event management (SIEM) features. NetApp Instaclustr, which sells managed OpenSearch, argues in its comparison Elasticsearch customers “will ultimately pay significantly more for the same product.”

Managed services, ingest, and cloud integration

Amazon OpenSearch Service runs managed and serverless OpenSearch on AWS. Aiven OpenSearch and NetApp Instaclustr also sell managed OpenSearch. Elastic Cloud is the only official managed Elasticsearch service; third parties such as Bonsai service resell it under license.

Elastic Cloud vs. Amazon OpenSearch Service

Elastic Cloud offers user-configured Hosted deployments or fully managed Serverless on AWS, Google Cloud, and Azure. Amazon OpenSearch Service, renamed in September 2021, offers provisioned domains and a serverless option and supports legacy Elasticsearch versions 1.5 through 7.10.

When you request quotes for managed OpenSearch, having several providers to choose from (Amazon, Aiven, NetApp Instaclustr, and others) gives you pricing leverage that a single-vendor market for Elasticsearch does not.

Data ingestion pipelines

Both engines accept telemetry from the common ingestion tools, though the default paths differ. Elasticsearch uses its built-in ingest pipelines and pairs cleanly with Beats and Logstash. OpenSearch relies on Data Prepper as its native pipeline, with managed OpenSearch Ingestion available as a serverless option on AWS.

Logstash also works with OpenSearch through a dedicated output plugin, and Fluent Bit and Fluentd support both engines. The main compatibility gap is Beats, where only older open-source releases work with OpenSearch.

Pricing and cost: Elasticsearch vs. OpenSearch

Cost comparisons split cleanly between managed and self-hosted deployments.

For managed services, both engines are priced on region, instance type, storage, support, data volume, and workload. Elastic Cloud is the sole official managed Elasticsearch service, while managed OpenSearch is sold by Amazon, Aiven, and NetApp Instaclustr, and that competition can move quotes. Compare equivalent configurations before you decide, and validate rates against the OpenSearch Service pricing page, which lists instance-hour rates and reserved-instance discounts.

For self-hosted deployments, the cost difference comes down to feature gates. OpenSearch ships security, alerting, anomaly detection, cross-cluster replication, and searchable snapshots for free under Apache 2.0. New self-managed Elasticsearch customers now choose between Free and Enterprise (Gold is discontinued and Platinum is closed to new customers), and cross-cluster replication, searchable snapshots, and SSO all require an Enterprise license without a published price.

Can you migrate from Elasticsearch to OpenSearch?

Yes. Migration difficulty depends on the Elasticsearch version you are starting from. OpenSearch keeps wire compatibility with the Elasticsearch 7.10 REST API and reads indices from Elasticsearch 6.0 through 7.10, so clusters in that range can move over with a rolling or blue/green upgrade. Elasticsearch 7.11 added an identifier field OpenSearch does not recognize, and later snapshots will not restore as a result. Clusters on 7.11 and above need a remote reindex, Logstash, or the OpenSearch Migration Assistant, which covers Elasticsearch 6.8 onward.

Going the other direction is harder. There is no official reverse tooling, and neither snapshot restore nor reindex-from-remote works from OpenSearch into Elasticsearch, according to Elastic’s migration write-up. Teams moving that way need an intermediary ETL layer.

How to choose: Elasticsearch or OpenSearch?

Licensing, governance, query behavior, feature gates, and managed-service availability create different tradeoffs. High-volume log management is the one workload where neither engine is the only category to evaluate. Match your hardest constraint to the considerations below.

Scenario	Relevant Considerations
AWS-native infrastructure, managed service preference	Amazon OpenSearch Service is the AWS-native managed option
Strict Apache 2.0 open-source licensing requirement	OpenSearch is licensed under Apache 2.0
Free enterprise security features required	OpenSearch includes security features in its Apache 2.0 distribution
Text-query-heavy search latency	The Trail of Bits test measured Elasticsearch as 2.42x faster on text queries
Advanced GenAI/RAG integration, proprietary machine learning	Elasticsearch provides licensed machine learning and managed GenAI tooling
Managed SaaS, single vendor	Elastic Cloud is Elastic’s official managed service
Cost-sensitive, multiple managed provider options	Several providers offer managed OpenSearch services
Primary use case: full-text search on document corpus	Both support full-text search; the cited independent benchmark found lower text-query latency for Elasticsearch
Primary use case: log analytics at high volume	Compare both engines with dedicated observability platforms, including Coralogix, based on your ingestion, retention, and query requirements

What about dedicated observability platforms?

Elasticsearch and OpenSearch handle search, analytics, and vector workloads, but the stakes change when the primary requirement is operational telemetry. If you run either engine mainly for log management or trace correlation, choosing only on search benchmarks can preserve an index tax that observability workloads rarely justify. The same concern applies to security analytics. The wrong architecture can force engineers to reduce retention, drop telemetry, or spend more time maintaining clusters.

For document search, vector retrieval, or application-facing search, evaluate Elasticsearch and OpenSearch against your query mix, licensing requirements, migration path, and managed-service constraints. For observability and high-volume log analytics, include Coralogix. Engineers can parse, enrich, and alert on telemetry as it arrives without indexing it first because Coralogix’s Streama engine analyzes data in-stream. This provides full visibility while avoiding an index-first architecture.

Everything lands in your own cloud bucket in open Parquet format, with unlimited retention at object-storage cost instead of managed search-engine rates. The TCO Optimizer reports customer cost reductions of 40–70%. That positioning is specific to log management, telemetry analytics, security analytics, and observability; Coralogix is not a replacement for every document-search or vector-search deployment.

Price your ingestion volume and retention period across relevant options, then account for your query patterns. To run that comparison on your data, book a demo.

Frequently asked questions about Elasticsearch vs. OpenSearch

Is Elasticsearch an ETL tool?

Elasticsearch is a search and analytics engine; Logstash parsing provides ingest-time processing that overlaps with ETL.

Can Elasticsearch snapshots be restored to OpenSearch?

OpenSearch can read indices from Elasticsearch 6.0 through 7.10. Snapshots from Elasticsearch 7.11 or later do not restore because Elasticsearch 7.11 added an identifier field OpenSearch does not recognize. Those migrations require remote reindexing, Logstash, or the OpenSearch Migration Assistant.

Is OpenSearch always more open than Elasticsearch?

OpenSearch is licensed under Apache 2.0. Elasticsearch used Apache 2.0 through version 7.10, moved to SSPL and Elastic License 2.0 in 2021, and added AGPLv3 for the free portions of its source code from version 8.16.0. Advanced Elastic features can still require a paid subscription.

Which engine supports larger vectors?

The cited mapping limits list a maximum of 4,096 float vector dimensions for Elasticsearch and 16,000 for OpenSearch. Elasticsearch uses Lucene HNSW, while OpenSearch supports Faiss and Lucene HNSW. Benchmark results vary by backend, filtering, engine version, and workload, so teams should reproduce tests with their own vectors and query patterns.