DEV Community

Vigilmon
Vigilmon

Posted on

How to Monitor Elasticsearch and OpenSearch with Vigilmon

#elasticsearch #monitoring #devops #opensearch

How to Monitor Elasticsearch and OpenSearch with Vigilmon

Elasticsearch and OpenSearch power search and analytics for millions of applications. When they go down, users lose search functionality, dashboards go blank, and log pipelines stall. This guide shows you how to monitor Elasticsearch and OpenSearch clusters with Vigilmon — covering HTTP checks, cluster health, and alert setup.

Why Monitor Elasticsearch?

Elasticsearch is critical infrastructure but notoriously tricky to monitor:

  • Cluster status can shift from green → yellow → red without warning
  • Individual node failures may not be immediately visible
  • The REST API exposes dozens of health metrics you need to watch
  • Disk space and JVM heap are common silent killers

What to Monitor in Elasticsearch

1. Cluster Health Endpoint

Elasticsearch exposes a built-in health check:

curl http://localhost:9200/_cluster/health
Enter fullscreen mode Exit fullscreen mode

Response:

{
  "cluster_name": "my-cluster",
  "status": "green",
  "number_of_nodes": 3,
  "number_of_data_nodes": 3,
  "active_shards": 120
}
Enter fullscreen mode Exit fullscreen mode

Status values:

  • green: All shards allocated — fully operational
  • yellow: Primary shards allocated, some replicas missing — degraded
  • red: Some primary shards unallocated — data loss risk

2. Node Availability 

curl http://localhost:9200/_nodes/stats
Enter fullscreen mode Exit fullscreen mode

3. Index Health 

curl http://localhost:9200/_cat/indices?v
Enter fullscreen mode Exit fullscreen mode

Setting Up Vigilmon for Elasticsearch

Monitor 1: Basic HTTP Availability

Create a monitor in Vigilmon for the root endpoint:

  • URL: http://your-es-host:9200
  • Method: GET
  • Expected status: 200
  • Check interval: 60 seconds
  • Multi-region: Enable (gets consensus across 3+ regions)

Monitor 2: Cluster Health Check

  • URL: http://your-es-host:9200/_cluster/health
  • Method: GET
  • Keyword check: Add "status":"green" (alert if this string is absent)
  • Alert on: Non-200 response OR keyword missing

This way Vigilmon alerts you the moment your cluster degrades from green.

Monitor 3: OpenSearch Health (Same Endpoint)

OpenSearch (AWS's open-source fork) uses identical API endpoints:

  • URL: https://your-opensearch-endpoint:9200/_cluster/health
  • Method: GET
  • Auth: Add your OpenSearch username/password as basic auth headers

Configuring Alerts

In Vigilmon, set up escalating alerts:

  1. Immediate alert (< 1 min): Slack or PagerDuty webhook when cluster goes red
  2. Degraded alert (> 2 min yellow): Email or SMS when cluster stays yellow
  3. Recovery notification: Auto-alert when cluster returns to green 
Settings → Monitors → [Monitor Name] → Alert Channels
Enter fullscreen mode Exit fullscreen mode

Multi-Region Consensus for Elasticsearch

Vigilmon checks from multiple geographic regions simultaneously. This eliminates false alerts caused by:

  • Network blips between your monitoring server and ES cluster
  • Single-point-of-failure in traditional monitoring setups
  • DNS resolution issues in specific regions

A true Elasticsearch outage will be confirmed from 3+ locations before alerting.

Monitoring Elasticsearch on AWS / Elastic Cloud

For managed Elasticsearch services:

  • AWS OpenSearch: Monitor the HTTPS endpoint AWS provides
  • Elastic Cloud: Use the Elasticsearch endpoint from your cloud console
  • Authentication: Set Authorization: ApiKey <your-key> header in Vigilmon monitor settings

Best Practices

  1. Monitor both HTTP and cluster health — a running ES instance can still have a red cluster
  2. Set appropriate timeouts — ES can be slow under load; set 10–30s timeout before alerting
  3. Alert on yellow too — yellow clusters are one node failure from red
  4. Monitor disk space indirectly — ES goes read-only at 85% disk; a keyword check on /_cluster/settings can catch flood watermarks
  5. Use separate monitors per node — for critical clusters, monitor each node individually

Quick Start Summary

Monitor URL Check
Availability http://es:9200 Status 200
Cluster Health http://es:9200/_cluster/health Keyword: green
Index Status http://es:9200/_cat/health Status 200

Conclusion

Elasticsearch and OpenSearch are powerful but require active monitoring. With Vigilmon, you get multi-region HTTP checks, keyword monitoring, and instant alerts — no agent installation, no complex setup.

Start monitoring your Elasticsearch cluster free at vigilmon.online

Top comments (0)