---
title: "Deploy Opensearch"
description: "Search engine and dashboards for querying your own data"
category: "Analytics"
url: https://railway.com/deploy/opensearch-analytics
---

# Deploy Opensearch

Search engine and dashboards for querying your own data

**[Deploy Opensearch on Railway](https://railway.com/template/opensearch-analytics)**

- **Creator:** A3A
- **Category:** Analytics

## Template content

### opensearch-dashboards https://raw.githubusercontent.com/opensearch-project/OpenSearch-Dashboards/main/src/core/server/core_app/assets/logos/opensearch_center_mark_on_dark.svg

- **Source:** https://github.com/gridalpha/opensearch-railway
- **Health check:** /api/status
- **Public domain:** Yes

### opensearch https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/opensearch.svg

- **Source:** https://github.com/gridalpha/opensearch-railway

## Buckets

- **opensearch-snapshots**

## Documentation

![OpenSearch logo](https://logit.io/uploads/banners/6qbyhVpkE5nMKCxsnrq5qB_opensearch_logo.svg)

# Deploy and Host OpenSearch on Railway

OpenSearch is an Apache-2.0 search and analytics engine built on Apache Lucene, forked from Elasticsearch 7.10 and now governed by the OpenSearch Software Foundation under the Linux Foundation. It stores JSON documents, indexes every field, and answers full-text, filter, aggregation and k-NN vector queries over a REST API. Teams use it for product search, log analytics, security analytics and AI retrieval — the same jobs Elasticsearch does, without a licence that changes underneath them.

This template lets you self-host OpenSearch on Railway with the security plugin switched on from the first boot. Two services are deployed: an **opensearch** node holding the data on a persistent volume, and **opensearch-dashboards**, the visualisation and administration UI, which is the only service with a public URL. Dashboards reaches the node over Railway's private network, so the search API is never exposed to the internet. A managed object storage bucket is attached as a snapshot repository with a daily snapshot policy, so the cluster has a real backup rather than one volume.

![Diagram of the OpenSearch and Dashboards services on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/v1787787250/opensearch-architecture.png)

## Getting Started with OpenSearch on Railway

Set an admin password when you deploy, then open the public Dashboards URL once both services report healthy — the node takes about a minute on its first boot to generate certificates and initialise the security index. Sign in as `admin` with the password you supplied; there are no default credentials, and the demo accounts that ship with the image are never installed. Dashboards asks which tenant to work in: pick **Global** to share saved objects with users you add later. The fastest way to confirm everything works is **Home → Add data → Sample flight data**, which creates an index, bulk-loads documents and installs a dashboard you can open at once. **Dev Tools → Console** then gives you a raw REST client: run `GET _cluster/health` and expect green or yellow. Add users under **Security → Internal users**, and point your application at the node on port 9200.

![OpenSearch Dashboards flight analytics dashboard with live charts](https://res.cloudinary.com/rroe4rtk/image/upload/v1787787252/opensearch-flight-dashboard.png)
![Dev Tools console returning search hits from the flights index](https://res.cloudinary.com/rroe4rtk/image/upload/v1787787254/opensearch-dev-tools-search.png)
![Snapshot Management listing a successful snapshot to object storage](https://res.cloudinary.com/rroe4rtk/image/upload/v1787787259/opensearch-snapshot-management.png)

## About Hosting OpenSearch

OpenSearch is a distributed document store with a query engine on top: you index JSON, it builds inverted indexes and doc values, and you query it over HTTP. Self-host it when you want the whole feature set without per-node licensing, when your data cannot leave your infrastructure, or when a managed search service costs more than the workload warrants.

- Full-text search with BM25 relevance, analysers, synonyms and highlighting
- Aggregations, alerting, anomaly detection and index lifecycle management
- k-NN vector search for semantic search and retrieval-augmented generation
- Role-based access control, tenants and audit logging
- SQL and PPL query interfaces alongside the JSON query DSL
- Snapshot and restore to S3-compatible object storage

The **opensearch** service is the engine and the only stateful component; its volume holds the Lucene indexes, the security configuration and the certificates it generates for itself. **opensearch-dashboards** is stateless — index patterns, visualisations and dashboards are all written back into the cluster. The bucket holds snapshots and nothing else.

## Why Deploy OpenSearch on Railway

Railway removes the operational work around a search cluster.

- Persistent volume attached and sized for the search node
- Private networking between Dashboards and the engine, with no public search API
- Managed object storage wired up as a snapshot repository on first boot
- TLS, domains and health checks handled by the platform
- JVM heap sized from the container's memory limit

## Common Use Cases for Self-Hosted OpenSearch

- **Product and site search** — faceting and relevance tuning behind a catalogue or docs site
- **Log and observability analytics** — ship logs in, then build dashboards and alerts
- **Security analytics** — correlate authentication and audit events with detectors and threat feeds
- **Vector search for AI** — store embeddings beside metadata and run hybrid keyword-plus-semantic retrieval

## Dependencies for OpenSearch on Railway

- **opensearch** — `opensearchproject/opensearch:3`, private, port 9200, 5 GB volume at `/usr/share/opensearch/data`
- **opensearch-dashboards** — `opensearchproject/opensearch-dashboards:3`, public, port 5601
- **Object storage bucket** — registered as the `railway-object-storage` snapshot repository

Both images are wrapped by [gridalpha/opensearch-railway](https://github.com/gridalpha/opensearch-railway), which adds the first-boot steps neither image can express: generating this deployment's own transport certificates, writing the internal user database from your password, and loading snapshot credentials into the OpenSearch keystore.

### Environment Variables Reference

| Variable | Service | Purpose |
|---|---|---|
| `OPENSEARCH_INITIAL_ADMIN_PASSWORD` | opensearch | `admin` password, read on first boot only |
| `DASHBOARDS_SERVICE_PASSWORD` | opensearch | Password for the `kibanaserver` account |
| `SNAPSHOT_SCHEDULE_CRON` | opensearch | Daily snapshot time in UTC, default `0 2 * * *` |
| `SNAPSHOT_RETENTION` | opensearch | Snapshot retention, default `14d` |
| `OPENSEARCH_JAVA_OPTS` | opensearch | Override the derived JVM heap |
| `DASHBOARDS_COOKIE_PASSWORD` | opensearch-dashboards | Encrypts the session cookie |
| `DASHBOARDS_EXTRA_CONFIG` | opensearch-dashboards | Extra Dashboards YAML |

### Deployment Dependencies

- [OpenSearch on GitHub](https://github.com/opensearch-project/OpenSearch)
- [OpenSearch documentation](https://docs.opensearch.org/)
- [opensearchproject/opensearch on Docker Hub](https://hub.docker.com/r/opensearchproject/opensearch)

## Hardware Requirements for Self-Hosting OpenSearch

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 2 vCPU | 4+ vCPU |
| RAM | 2 GB | 8 GB or more |
| Storage | 5 GB volume | Roughly 1.5× your raw data |
| Runtime | Bundled JDK | Bundled JDK |

Half the container's memory goes to the JVM heap and the rest to the Lucene page cache, so raising the service's memory limit is the most effective tuning step. The heap is recalculated from the container limit on every boot, so a resize applies on the next deploy.

## Self-Hosting OpenSearch with Docker

Outside Railway, the smallest useful setup is one container with the demo security configuration:

```
docker run -d --name opensearch \
  -p 9200:9200 -p 9600:9600 \
  -e discovery.type=single-node \
  -e node.store.allow_mmap=false \
  -e OPENSEARCH_INITIAL_ADMIN_PASSWORD='Str0ng-Passw0rd!' \
  -v opensearch-data:/usr/share/opensearch/data \
  opensearchproject/opensearch:3
```

`node.store.allow_mmap=false` matters wherever you cannot raise `vm.max_map_count`, which is most container platforms. Then index a document and search for it:

```
curl -k -u admin:'Str0ng-Passw0rd!' -X POST https://localhost:9200/products/_doc \
  -H 'Content-Type: application/json' \
  -d '{"name":"wireless keyboard","price":49.99}'

curl -k -u admin:'Str0ng-Passw0rd!' \
  'https://localhost:9200/products/_search?q=name:keyboard'
```

## How Much Does OpenSearch Cost to Self-Host?

OpenSearch is free and open source under Apache 2.0 — no paid tier, no feature gating, no licence key. Security, alerting, anomaly detection and vector search are all in the box. Self-hosting on Railway costs only the compute, memory, volume and object storage the two services use, so the bill scales with index size rather than a per-node price list.

## OpenSearch vs Elasticsearch

| | OpenSearch | Elasticsearch |
|---|---|---|
| Licence | Apache 2.0 | Elastic Licence / SSPL / AGPL |
| Governance | OpenSearch Software Foundation | Elastic N.V. |
| Security features | Included | Some tiers paid |

The two diverged in 2021 and are no longer client-compatible, so use a library built for OpenSearch. From Elasticsearch 7.10 or earlier, migration is a snapshot restore.

## FAQ

**What is OpenSearch?**
An open-source search and analytics engine built on Apache Lucene. It stores JSON documents and answers full-text, aggregation and vector queries over a REST API.

**What does this Railway template deploy?**
An OpenSearch node with a persistent volume and the security plugin enabled, a Dashboards service with a public URL, and an object storage bucket registered as a snapshot repository.

**Why does the template include object storage?**
A single volume is one copy of your data. Snapshots give you a restorable backup, and a daily policy is created for you.

**How do I change the admin password after deploying OpenSearch?**
The variable is read only while the security index is created. After that, change it under **Security → Internal users** in Dashboards.

**How do I connect my application to self-hosted OpenSearch?**
Deploy your app into the same Railway project and point your client at `http://opensearch.railway.internal:9200` with the credentials you created. The search API stays private.

**Can I run a multi-node OpenSearch cluster on Railway?**
This template runs a single node, the right shape for most self-hosted workloads. Scale it by raising the service's memory and volume, and rely on snapshots.


## Similar templates

- [Betterlytics](https://railway.com/deploy/betterlytics) — Betterlytics is a cookieless analytics platform GDPR-compliant.
- [Finance Tracker](https://railway.com/deploy/finance-tracker-1) — Private multi-user household finance ledger with budgets and CSV import.
- [Matomo Analytics + MariaDB](https://railway.com/deploy/matomo-analytics-mariadb) — Privacy-friendly analytics with MariaDB and persistent volumes.

Open this page in a browser: https://railway.com/deploy/opensearch-analytics