Skip to main content
Question

AWS OpenSearch Service and Cribl

  • March 11, 2025
  • 3 replies
  • 110 views

Has anyone connected up an AWS Opensearch Service instance to Cribl? I created a local backend user in my domain and gave it what I thought were good permissions but I still get a 401 error when I test the connection. Can anyone share what they did to get this to work?

    3 replies

    Hi, there I have set up Stream to send to Opensearch before. Can you please post a screenshot of the error?

    What destination are you attempting to use?

    Additional note for others reading this thread: Please note that only local users are supported today in Cribl Stream. IAM role authentication has been requested as an enhancement request under ticket CRIBL-5748.

    Hi @Austinr, were you able to resolve your problem? I just tested and was able to send data to an AWS hosted OpenSearch deployment.

    How I configured my instance:

    1. Created OpenSearch internal user cribl-workers.

    2. Created new OpenSearch role cribl-stream and mapped the cribl-workers user to the role.

    3. For role permissions, I granted:
      a. indices:data/write/bulk for Cluster permissions
      b. create_index and write under Index permissions mapped to my index pattern my-index-*91_07871c500fc344c7995af82da307ad4e.png
    4. Added a new Elasticsearch destination in Cribl Stream. I entered my Domain endpoint followed by /_bulk as the API URL.91_37cca7fd9f454e5c8fb867e19bf2ee00.png
    5. After Commit & Deploy, I ran the test and saw data in my ES instance after adding an Index mapping.91_4e642c40e6a44d65b5c149d2ae8c1834.jpeg
    Terms & ConditionsAccessibility statement