Read from OpenSearch

The OpenSearch input plugin reads the search query results performed on an OpenSearch cluster and loads them into Logstash. This lets you replay test logs, reindex, and perform other operations based on the loaded data. You can schedule ingestions to run periodically by using cron expressions, or manually load data into Logstash by running the query once.

To ingest data according to a schedule, use a cron expression that specifies the schedule you want. For example, to load in data every minute, add schedule => "* * * * *" to the input section of your file.

config/pipeline.conf is a relative path to the file. You can use an absolute path as well.

To reindex the data into an OpenSearch domain, add the destination domain configuration in the section like shown .