Side-by-side Elasticsearch vs OpenSearch comparison - performance, features, AI/vector search, security, licensing, managed services, and migration. Updated 2026.

OpenSearch vs Elasticsearch Compared (2026): Performance, Cost, AI

Elasticsearch has been around since 2010, built on top of the Apache Lucene search library (the same foundation that powers Apache Solr). It quickly became the industry standard for full-text search, log analytics, and real-time BI. In January 2021, with the 7.11 release, Elastic moved Elasticsearch off Apache 2.0; Amazon then forked Elasticsearch 7.10.2 to create OpenSearch under the Apache License 2.0, and rebranded Amazon Elasticsearch Service as Amazon OpenSearch Service. So when people ask about AWS Elasticsearch vs OpenSearch today, they're really asking about Amazon OpenSearch Service versus Elastic Cloud on AWS — the original AWS-managed Elasticsearch product no longer exists. This OpenSearch vs Elasticsearch comparison reflects how the two projects have diverged since the fork.

Both Elasticsearch and OpenSearch shipped major version bumps in 2025 - Elasticsearch 9.0 in April, OpenSearch 3.0 in May. These weren't minor increments. Both upgraded to Lucene 10, introduced breaking changes, and continued to diverge in product direction: Elastic is steering more toward an integrated platform for security, AI, observability, and search, while OpenSearch remains more focused on the core engine, analytics, and extensible open source infrastructure. The two projects still share the same DNA from the 2021 fork, so core search and core log analytics behavior remains broadly comparable, but their surrounding solutions and priorities now differ significantly. Both also now offer serverless options - Elasticsearch via Elastic Cloud Serverless, and OpenSearch via Amazon OpenSearch Serverless.

At BigData Boutique, we've worked with both technologies for over 15+ years and now maintain production clusters for clients across search, analytics, and observability workloads. We recently joined the OpenSearch Software Foundation as a General Member. This comparison reflects what we see across thousands of real-world deployments - not vendor marketing.

What is the difference between Elasticsearch and OpenSearch?

Same Lucene core, same basic search and log analytics — the difference between Elasticsearch and OpenSearch is licensing, governance, where the projects put their energy, and how they're sold. Elasticsearch is the integrated, mostly-paid Elastic platform: search, AI, observability, and SIEM under one roof, and Elastic Cloud is the only place to buy it managed. OpenSearch is the Apache 2.0 alternative, governed by the OpenSearch Software Foundation under the Linux Foundation, with enterprise security (LDAP, SAML, field-level), alerting, ML, and searchable snapshots free out of the box. The managed-service market for OpenSearch is competitive — Amazon, Aiven, Instaclustr, and others — while Elasticsearch is sold by Elastic only. We'll walk through each of these areas below.

Project Status, Governance, and Licensing

Elasticsearch is now triple-licensed under AGPLv3, SSPL 1.0, and Elastic License 2.0 (user's choice). Elastic added AGPL in late 2024, which means parts of the source are again available under an OSI-approved license. In practice, though, Elastic's default distributions and managed offerings remain under Elastic License 2.0, and commercial features (formerly bundled as X-Pack) sit behind paid subscriptions. For most organizations embedding Elasticsearch as a backend in their own application — not offering it as a managed service — there is effectively zero licensing risk. Vendors offering hosted Elasticsearch as a service still require careful legal review.

OpenSearch stays on Apache 2.0 - the most permissive widely-used open source license. In September 2024, AWS transferred governance to the OpenSearch Software Foundation (OSSF) under the Linux Foundation. The foundation has grown since: BigData Boutique, OpenSource Connections, and Resolve Technology joined as General Members in March 2026, alongside 400+ contributing organizations and 3,000+ active contributors. This is no longer just "AWS's project" - it has vendor-neutral governance with a Technical Steering Committee and an open roadmap.

On the version front: Elasticsearch is at 9.3.3 (April 2026), OpenSearch at 3.6 (April 2026). Both are on Lucene 10 and Java 21+.

Elasticsearch OpenSearch
License AGPLv3 / SSPL / ELv2 (triple) Apache 2.0
Governance Elastic Co OSSF (Linux Foundation)
Latest Version 9.3.3 (Apr 2026) 3.6 (Apr 2026)
Lucene Version 10 10
Release Cadence ~Monthly minors ~Bimonthly minors

Codebase Activity

Pulling commit counts from GitHub for both repositories since the April 2021 fork (as of May 2026): roughly 41,000 commits on elastic/elasticsearch versus 5,800 on opensearch-project/OpenSearch — about 7× more code activity on the Elasticsearch side. Elastic has continued shipping monthly minors against OpenSearch's bimonthly cadence through 2025-2026, and the commit gap has widened over time rather than closed. That said, raw commit counts overstate the gap on core engine work: a large share of activity on the Elasticsearch side lands in X-Pack and commercial-tier modules — Security, ML/inference, ES|QL tooling, observability solutions, Enterprise Search, Fleet, and Kibana-adjacent integrations — rather than in the core search and indexing server. On the core Elasticsearch server itself (Lucene integration, query execution, distributed coordination, storage), the activity gap with OpenSearch is meaningfully narrower.

Performance and Scalability

Both projects share the Lucene core, which means raw text search and core log analytics performance is broadly comparable on equivalent hardware and configurations. The differences show up in the optimizations built on top of Lucene, the surrounding platform features, and in specialized workloads. In practice, either engine can win on specific operations depending on the version, data model, and query mix; for vector database-style workloads, OpenSearch's Faiss support gives it a meaningful flexibility advantage.

Elasticsearch 9.x brought ES|QL to full production readiness. LogsDB index mode reached GA with up to 65% storage reduction for log data through synthetic source and doc-value-only fields. Elastic has also been pushing further into log processing and AI-assisted workflows through Streams, though some of the newer automation capabilities were still rolling out in preview form across the 9.x line.

OpenSearch 3.0 claims a 9.5x performance improvement over OpenSearch 1.3, with range queries 25% faster on the Big5 benchmark suite. Concurrent segment search is now enabled by default. OpenSearch 3.0 also introduced experimental gRPC support and experimental pull-based ingestion from Apache Kafka and Amazon Kinesis, pointing to a broader push on ingestion and transport efficiency.

A word on benchmarks: vendor-published numbers are marketing. Elastic's own benchmarks show 40-140% better performance than OpenSearch on log analytics workloads. An independent Trail of Bits benchmark from March 2025 found OpenSearch faster on Big5 mixed workloads. The truth depends on your workload, hardware, and configuration. For text search, the difference is usually marginal. For specialized workloads - vector search, time-series, log analytics - the engine-specific optimizations matter more than the shared Lucene foundation.

Query Languages

Both platforms now have dedicated query languages competing for the same space. Elasticsearch has ES|QL, a pipe-based language tightly integrated into Kibana with autocomplete and visualization support. OpenSearch has PPL (Piped Processing Language), which received substantial updates in OpenSearch 3.3 with new commands and functions for log analytics and observability workflows. Both also support SQL. The choice between them is largely an ecosystem decision - if you're on Kibana, ES|QL is the natural fit; if you're on OpenSearch Dashboards, PPL is.

Core Feature Differences

While the core search and analytics functionality remains broadly the same, some features have diverged in naming, availability, or direction:

  • Index Lifecycle Management vs Index State Management: Elasticsearch calls it ILM, OpenSearch calls it ISM. Both handle time-based index rollover, retention, and deletion, but the APIs and policy syntax differ.
  • Rollups: Elasticsearch deprecated and removed its rollup feature in favor of downsampling in the TSDB index mode. OpenSearch still supports index rollups as part of ISM.
  • Cross-cluster replication: Both support CCR, but in Elasticsearch it requires a Platinum/Enterprise subscription. In OpenSearch, cross-cluster replication is a free, built-in feature.
  • Cross-cluster search: Available in both, free in OpenSearch, requires a paid license in Elasticsearch for some configurations.

Vector Search and AI Capabilities

This is where the two projects diverge the most, and where the competition has been fiercest in 2025-2026.

Vector Engines and Dimensions

Both platforms support dense vector fields for storing embeddings used in semantic search, RAG, and AI workflows.

Elasticsearch uses Lucene's native HNSW as its sole vector engine. It compensates with aggressive quantization innovations: BBQ (Better Binary Quantization) became the default for vectors with >=384 dimensions in ES 9.1, reducing memory by 95%+ compared to float32. DiskBBQ (GA in 9.2) makes disk-backed vector search a practical option for cost-sensitive deployments with very large indexes. NVIDIA cuVS GPU acceleration is in tech preview in 9.3, delivering up to 12x faster indexing. A significant limitation is the max vector dimensions: 4,096 - which may become a constraint as newer embedding models trend toward higher dimensionality.

OpenSearch supports two vector engines: Lucene HNSW and Faiss (Facebook AI Similarity Search). Note that nmslib was deprecated in OpenSearch 2.16 and removed for new index creation in 3.0. Faiss provides IVF (Inverted File Index) and product quantization (PQ) as alternatives to HNSW, which matter for workloads where memory is constrained or where approximate search with different recall/latency tradeoffs is needed. OpenSearch supports multiple quantization methods: byte vectors, FP16, product quantization, and binary quantization (since 2.17, via Faiss with 32x compression). OpenSearch also has its own disk-based vector search mode - it uses a two-phase approach where a compressed binary-quantized index lives in memory and full-precision vectors are rescored from disk, cutting costs by roughly 67%. It doesn't have Elasticsearch's BBQ yet, though there's an active RFC to integrate Lucene's BBQ. Concurrent segment search for k-NN is enabled by default in 3.0, delivering up to 2.5x faster vector queries. Max vector dimensions: 16,000 via Faiss - nearly 4x Elasticsearch's 4,096 limit. This is a meaningful differentiator as newer embedding models increasingly use higher dimensionality, and Elasticsearch's Lucene-only approach is constrained by Lucene's own dimension limits. For exact (brute-force) k-NN, OpenSearch's script_score exposes l1Norm, l2Squared, cosineSimilarity, and dotProduct functions when ANN recall is insufficient.

Elasticsearch 9.x OpenSearch 3.x
Vector Engines Lucene HNSW Lucene HNSW, Faiss
Max Dimensions 4,096 16,000
Default Quantization BBQ (9.1+) Configurable (byte, FP16, PQ, binary)
Disk-based Search DiskBBQ (GA 9.2) Faiss with disk mode
GPU Acceleration cuVS (tech preview 9.3) Via Amazon OpenSearch Service
ANN Algorithms HNSW HNSW, IVF

Machine Learning

Both engines support inline ML — Elasticsearch via trained models and ELSER, OpenSearch via Neural Search and ML Commons. Elasticsearch additionally offers built-in Learning-to-Rank (LTR) rescoring. Our recommendation across both: don't run heavy training or inference on the cluster — use it as a serving layer and offload model training and large-batch embedding generation to dedicated GPU infrastructure. Mixing both in the same JVM contends for memory and degrades search latency.

RAG Workflows and AI Agents

Elasticsearch's ESRE (Elasticsearch Relevance Engine) and Retriever framework together provide a comprehensive RAG pipeline that can encapsulate the full complexity of retrieval-augmented generation - from generating embeddings at index and query time to executing multi-stage retrieval pipelines in a single _search call, combining knn, RRF, text similarity reranking, diversification, and rule-based pinning. The Jina AI acquisition (October 2025) brought three multilingual embedding models directly into the Elastic Inference Service. The Elastic Agent Builder (GA January 2026) lets developers build AI agents over Elasticsearch data with natural language, and supports MCP server import/export for integration with Claude Desktop, Cursor, and LangChain.

OpenSearch took a different path, building on its Neural Search query type which allows running ML models (local or remote) during query and index time to generate embeddings and power semantic search natively. The agentic search capability, introduced in the 3.x line, uses the Flow Framework plugin to orchestrate AI-driven search workflows, achieving 82% query translation accuracy and up to 235% relevance improvements in evaluation benchmarks. OpenSearch 3.4 added a no-code UX for building agents with MCP integration. The Launchpad (April 2026) is an AI-powered tool that generates a running search application from plain-language requirements in minutes - a real time-saver for teams new to search.

Perhaps the most distinctive OpenSearch AI feature is Agent Health - open-source observability and evaluation specifically for AI agents. It provides trace-level visibility into agent execution, automated benchmarking, and LLM-as-judge evaluation. For teams running AI agents in production, this addresses a real gap: agents fail silently, and without dedicated monitoring you won't know until users complain.

Solutions, Ecosystem, and Security

Observability

Elastic's observability stack remains the more mature offering. Full OpenTelemetry support with a managed OTLP endpoint (available from October 20, 2025) means you can ship traces directly from OTel SDKs without running a local collector. Combined with APM, log correlation, and ES|QL, Elastic offers a complete observability platform that competes with Datadog and Splunk.

OpenSearch has been closing the gap. The OpenTelemetry integration in OpenSearch 3.1 provides service maps and trace analytics for distributed microservices (see our practical guide to OpenTelemetry with OpenSearch for a hands-on walkthrough). PPL's expanded observability commands in 3.3 streamline log analytics workflows. OpenSearch Dashboards also continued to unify log analytics, distributed tracing, and visualizations in the 3.x line.

SIEM and Security Features

Elastic Security is a full-blown SIEM with detection rules, SOAR automation, and threat intelligence integrations. Elastic was also recognized in analyst coverage for security analytics in 2025. For organizations that need an enterprise-grade SIEM, this is a strong differentiator.

OpenSearch doesn't offer a directly comparable built-in SIEM, though it does include a Security Analytics module with basic detection functionality. For fuller SIEM/XDR use cases, Wazuh - an open source XDR and SIEM built on OpenSearch - fills this gap for many deployments.

Where OpenSearch wins decisively is on built-in security features. LDAP, Active Directory, SAML, OpenID authentication, role-based access control, field-level security, document-level security, audit logging - all of this is free and open source in OpenSearch. Elasticsearch includes core security and RBAC in its free Basic tier, but features like LDAP/AD, SAML/OIDC SSO, document- and field-level security, and audit logging require paid subscriptions. For organizations that need those enterprise controls without additional licensing costs, OpenSearch has a clear advantage.

Client Libraries

OpenSearch's client library ecosystem was historically a weak spot for the project, but has matured considerably. Officially maintained clients now exist for Python, Java, JavaScript, Go, Ruby, PHP, .NET, and Rust — Python and Java are the most production-ready, while some others lag in feature parity behind Elasticsearch's first-party clients. For breadth and developer experience Elasticsearch's clients still lead, but OpenSearch is closing the gap.

Data Ingestion

When the fork happened, Elasticsearch enforced version checks in Logstash, Beats, and its client libraries, blocking connections to OpenSearch clusters. This created a significant divergence in the data ingestion ecosystem.

Logstash can send data to OpenSearch via the logstash-output-opensearch plugin, maintained by the OpenSearch project. However, OpenSearch recommends staying on Logstash 7.16.x or earlier for guaranteed compatibility - newer Logstash versions may work but aren't actively tested against OpenSearch.

Beats (Filebeat, Metricbeat, etc.) have more limited OpenSearch support. Beats 7.12.x and earlier work natively with OpenSearch, but newer versions include validation that rejects non-Elasticsearch clusters. The common workaround is to route Beats through Logstash with the OpenSearch output plugin.

For new OpenSearch deployments, Data Prepper is the recommended ingestion solution. It's purpose-built for OpenSearch with native OpenTelemetry support, and offers better throughput and lower latency than Logstash for OpenSearch workloads. Dedicated connectors also exist for Kafka (via Kafka Connect) and Flink.

None of this is an issue for Elasticsearch - Logstash, Beats, and Elastic Agent all work seamlessly as part of the Elastic Stack.

Monitoring

Monitoring your cluster is crucial for maintaining its health, performance, and stability. Both Elasticsearch (via Kibana Stack Monitoring) and OpenSearch (via OpenSearch Dashboards) offer built-in tools for cluster monitoring. The managed solutions add their own layers - Elastic Cloud provides cluster monitoring on its control plane, and Amazon OpenSearch Service offers CloudWatch metrics. For deeper guidance on tooling choices, see our breakdowns on selecting an Elasticsearch monitoring tool and choosing the right Amazon OpenSearch monitoring tool.

However, built-in monitoring only tells you what's happening - not what you should do about it. For actionable insights, Pulse provides automated monitoring and recommendations for both Elasticsearch and OpenSearch clusters. Beyond dashboards and metrics, Pulse acts as an automated consultant - identifying issues, explaining their impact, and providing specific, tailored recommendations to keep your clusters healthy and performant.

Support

OpenSearch is a community-driven open source project, which means there is no official vendor support from the project itself. Managed services like Amazon OpenSearch Service handle infrastructure, but not how you use the technology. For organizations that need expert support, BigData Boutique is the first accredited OpenSearch LTS support provider, offering 24/7 production support, consulting, and hands-on development services.

Elastic offers support through its subscription licenses and Elastic Cloud. For organizations running self-managed Elasticsearch who want an alternative to Elastic's own support, BigData Boutique also provides independent Elasticsearch support - often more tailored and hands-on than what's available through standard vendor subscriptions.

Pricing and Cost Efficiency

Both technologies are free to run self-managed. The cost picture changes dramatically once you factor in managed services and licensed features.

AWS Elasticsearch vs OpenSearch: the managed-service question

If you're sizing up AWS Elasticsearch vs OpenSearch today, the choice is between Amazon OpenSearch Service (which runs OpenSearch and replaced the old Amazon Elasticsearch Service) and Elastic Cloud running Elasticsearch on AWS. There is no AWS-managed Elasticsearch product anymore. So Amazon OpenSearch vs Elasticsearch at the managed-service layer is really Amazon OpenSearch Service against Elastic Cloud, and on equivalent workloads Amazon OpenSearch Service comes in 30-50% cheaper — without paying extra for enterprise security, cross-cluster replication, or searchable snapshots. The Elastic vs OpenSearch vendor angle matters too: only Elastic sells managed Elasticsearch, while OpenSearch has multiple managed providers competing on price.

Managed service options: Elasticsearch is available only on Elastic Cloud (deployable on AWS, GCP, Azure) and as an Azure native integration. OpenSearch has multiple competing providers: Amazon OpenSearch Service, Aiven, Instaclustr (NetApp), and others. More competition means lower prices.

Searchable Snapshots

Searchable snapshots serve queries directly from object storage (S3, GCS, Azure Blob) instead of keeping cold data on SSD-backed nodes — branded as Ultrawarm on Amazon OpenSearch Service and the frozen tier on Elastic Cloud. Highly relevant for log analytics and observability workloads where most data is cold. In OpenSearch, searchable snapshots are free. In Elasticsearch, they require an Enterprise subscription.

Amazon OpenSearch Service continues to add cost-optimization features: GPU acceleration for bulk indexing and vectorization workflows, and Zstandard (zstd) compression for up to 32% index size reduction. Elastic Cloud updated its serverless pricing model in late 2025, moving to VCU-based compute pricing.

On a like-for-like basis, Amazon OpenSearch Service is typically 30-50% cheaper than Elastic Cloud for equivalent workloads. Factor in the licensing cost for features that are free in OpenSearch (security, searchable snapshots, cross-cluster replication) and the gap widens further.

Summary

Feature Elasticsearch 9.x OpenSearch 3.x
License AGPLv3 / SSPL / ELv2 Apache 2.0
Governance Elastic Co OSSF (Linux Foundation)
Vector Engines Lucene Lucene, Faiss
Max Vector Dimensions 4,096 16,000
Vector Quantization BBQ (default), DiskBBQ, int8, bfloat16 Byte, FP16, PQ, binary (32x)
Disk-based Vector Search DiskBBQ (GA 9.2) Faiss on_disk mode (2-phase rescore)
RAG Framework ESRE + Retrievers (GA) Neural Search + Flow Framework + Agentic Search (GA)
AI Agent Builder Elastic Agent Builder + MCP No-code agent builder + MCP
AI Agent Monitoring Via APM Agent Health (dedicated)
Query Language ES|QL PPL + SQL
Security (LDAP, SAML) Paid subscription Free, built-in
Searchable Snapshots Paid (Enterprise, "frozen tier") Free ("Ultrawarm" on AWS)
APM / SIEM Full-featured, mature Basic (Wazuh for SIEM)
Data Ingestion Logstash, Beats, Elastic Agent Data Prepper, Logstash (via plugin), Kafka Connect
Managed Options Elastic Cloud Amazon OpenSearch, Aiven, Instaclustr, others
Support Elastic subscriptions, Elastic Cloud Community + accredited providers (BigData Boutique)
Onboarding Kibana guided setup Launchpad (AI-powered)

When to choose Elasticsearch:

  • You need the full Elastic platform - APM, SIEM, Enterprise Search as integrated solutions
  • Your team already invests in the Elastic ecosystem and Kibana
  • You need the most polished, integrated RAG developer experience
  • Licensing terms are acceptable for your use case

When to choose OpenSearch:

  • Cost efficiency is a priority, especially for observability and log analytics workloads
  • You need permissive licensing (Apache 2.0) for embedding in commercial products or offering as a service
  • Vector search at scale is a primary use case - Faiss support, higher dimensions, and more quantization options give you flexibility
  • You want enterprise security features (LDAP, SAML, field-level security) without additional licensing costs
  • You prefer vendor-neutral governance and a broader choice of managed service providers

When it genuinely doesn't matter: For standard text search, core log analytics workflows, dashboards, and basic alerting - the Elasticsearch vs OpenSearch choice is largely about ecosystem, team expertise, and total cost of ownership. The core functionality is very similar.

Is OpenSearch better than Elasticsearch?

Neither is universally better than Elasticsearch or universally better than OpenSearch — it depends what you're optimizing for. OpenSearch is better than Elasticsearch if you care about Apache 2.0 licensing, lower managed-service costs, vendor neutrality, or getting LDAP/SAML and searchable snapshots without a paid subscription. Elasticsearch is the better choice if you want one vendor delivering a polished, integrated stack across search, AI, observability, and SIEM, and the licensing works for you. For most teams running plain search and log analytics, OpenSearch vs Elasticsearch is close enough at the engine level that the decision usually comes down to cost and which ecosystem your team already lives in.

Frequently Asked Questions

Is OpenSearch the same as Elasticsearch?

No. OpenSearch is an Apache 2.0 fork of Elasticsearch 7.10.2, created by Amazon in April 2021 after Elastic changed its license. The two projects share the Lucene core and core search behavior, but have diverged in features, governance, licensing, and ecosystem since the fork.

Why did Amazon fork Elasticsearch?

In January 2021, Elastic moved Elasticsearch from Apache 2.0 to a dual SSPL/Elastic License 2.0 model with the 7.11 release, which restricted offering Elasticsearch as a managed service. Amazon and partners forked the last Apache 2.0 version (7.10.2) and rebranded it as OpenSearch in April 2021.

Is Elasticsearch still open source?

Partially. Since late 2024, Elasticsearch source is also available under AGPLv3 (an OSI-approved license) in addition to SSPL and Elastic License 2.0. For internal backend use, embedding Elasticsearch in your own application carries effectively zero licensing risk. Offering it as a managed or SaaS service still requires careful legal review.

What is the difference between OpenSearch and Amazon Elasticsearch Service?

Amazon OpenSearch Service is the rebranded successor to Amazon Elasticsearch Service, renamed in 2021 after the OpenSearch fork. It runs OpenSearch, not Elasticsearch. The legacy Amazon Elasticsearch Service name and its Elasticsearch-based engines are deprecated.

Can I migrate from Elasticsearch to OpenSearch?

Yes. For Elasticsearch versions up to 7.10.x, migration is generally straightforward via snapshot/restore or reindex-from-remote. For Elasticsearch 8.x and 9.x, data and queries usually require adaptation due to API divergence. See our migration from Elasticsearch to OpenSearch guide for a step-by-step playbook.

Which is faster, Elasticsearch or OpenSearch?

It depends on the workload. Elastic benchmarks claim 40-140% better Elasticsearch performance on log analytics; an independent Trail of Bits benchmark from March 2025 found OpenSearch faster on the Big5 mixed workload. For text search and core log analytics, the gap is usually marginal. For specialized workloads, version-specific optimizations matter more than the engine choice.

Which is cheaper, Elasticsearch or OpenSearch?

OpenSearch is typically 30-50% cheaper than Elasticsearch on managed services, mostly because Amazon OpenSearch Service competes with Aiven, Instaclustr, and others, while Elasticsearch is only available on Elastic Cloud. Features like LDAP/SAML security, cross-cluster replication, and searchable snapshots are also free in OpenSearch but paid in Elasticsearch.

OpenSearch has a flexibility advantage: support for both Lucene HNSW and Faiss (with IVF and product quantization), a 16,000-dimension limit, and a disk-based Faiss mode. Elasticsearch leads on quantization defaults: BBQ and DiskBBQ are mature and aggressively tuned. Max Elasticsearch vector dimensions remain 4,096.

What is X-Pack and does OpenSearch have it?

X-Pack is the historical name for Elastic's commercial bundle: security, alerting, monitoring, ML, graph, and Watcher. Most X-Pack features are now embedded in Elasticsearch under various paid tiers. OpenSearch ships LDAP/SAML, alerting, monitoring, ML, and audit logging as free, built-in modules; there is no equivalent of X-Pack because OpenSearch does not have an open-source-vs-paid split.

Need help with your Elasticsearch vs OpenSearch decision, or planning a migration between the two? Our team has guided hundreds of companies through this evaluation and through migrations to either platform. See our migration from Elasticsearch to OpenSearch guide and our 9 Elasticsearch alternatives breakdown. Reach out to us to discuss, or check out our OpenSearch consulting and Elasticsearch support services.