Skip to main content
Connect your OpenSearch cluster to let CloudThinker agents review indices, mappings, shards, cluster health, documents, queries, and relevance explanations. OpenSearch authenticates with the cluster URL and a basic-auth user. The connection is read-only by design — agents can list, search, count, and explain, and your search environment stays unchanged during investigation.

​
Prerequisites

  • An OpenSearch cluster reachable from the internet over HTTPS, or from wherever your CloudThinker deployment runs.
  • A basic-auth user scoped to the indices this workspace should reach — not the cluster admin.

​
Setup

1

Create a dedicated user

In your cluster’s security settings, create a user with read access to the indices agents should investigate.
2

Add the connection in CloudThinker

Navigate to Connections → OpenSearch and enter:
  • Cluster URL: the cluster endpoint, such as https://opensearch.internal:9200
  • Username and Password: the dedicated user’s credentials
  • Connection timeout (seconds): a value such as 15 — without it, an unreachable cluster stalls the conversation turn instead of failing
Click Connect. CloudThinker verifies the credentials and shows a Connected status.

​
Connection details

A TLS verification failure surfaces as a hung call rather than an error, so set Connection timeout (seconds) whenever you change Verify TLS certificate.

​
Required permissions

Grant the user read access to the target indices and cluster health. The connection exposes only read operations — list indices, read mappings, search, count, multi-search, shard and cluster health checks, and query explanations — so write permissions on the user are wasted surface.
Scope the user to the indices agents actually need. A cluster-admin credential grants nothing extra here and widens the blast radius if it leaks.

​
Agent capabilities

Once connected, agents have read access to your cluster:

​
Verify the connection

​
Example prompts

​
Troubleshooting

The username or password is wrong, or the user was removed. Update the credentials on the connection.
The cluster is unreachable, or TLS verification is failing against a self-signed certificate. Set Connection timeout (seconds), and set Verify TLS certificate to false only if the cluster genuinely serves a self-signed certificate.
The basic-auth user lacks read access to that index. Widen the user’s index permissions in the cluster’s security settings.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Read-only surface — the connection cannot write, delete, or change cluster settings, whatever the user’s permissions allow.
  • TLS verification on — keep certificate verification enabled unless the cluster serves a self-signed certificate you trust.

Elasticsearch Connection

Search and log analytics

Graylog Connection

Centralized log management