Searches are slow on a provisioned-node Amazon OpenSearch Service domain. A CloudWatch Logs group and resource policy allowing delivery are ready.
Investigate slow shard-level search processing alongside cluster health and node pressure at the same time. Shard search slow logs retain their disabled defaults.
Choose TWO appropriate checks.
Configure index thresholds and publishing, then correlate search slow logs with actual cluster and node metrics.
Detailed explanation
Shard allocation and node CPU/heap pressure provide context for the search logs.
Shard allocation and node CPU/heap pressure provide context for the search logs.
Both delivery configuration and index-level log-generation thresholds are required.
Both delivery configuration and index-level log-generation thresholds are required.
Green describes shard allocation; it does not guarantee fast searches or spare CPU and heap capacity.
Green describes shard allocation; it does not guarantee fast searches or spare CPU and heap capacity.
Shard processing times do not cover the same scope as a complete search request or the user response. Do not identify their simple sum with end-to-end latency; align the measurement scope during investigation.
Shard processing times do not cover the same scope as a complete search request or the user response. Do not identify their simple sum with end-to-end latency; align the measurement scope during investigation.
Publishing alone does not enable generation of shard slow logs whose thresholds remain disabled.
Publishing alone does not enable generation of shard slow logs whose thresholds remain disabled.
Check official documentation
Compare the following points with the official documentation.
Review shard slow log publishing, index settings, and AWS/ES metric names and dimensions.
Official references
What to confirm
Explain why publishing alone is insufficient and distinguish shard time, cluster health, and user response latency.
Key points
- Slow search log
- ClusterStatus.red
- JVMMemoryPressure
Notes
- Environment: AWS SOA-C03 exam guide and the linked AWS documentation
- Reviewed against the linked AWS documentation on 2026-10-09.
Foundation review
Configure log generation and delivery
Configure domain publishing separately from index.search.slowlog.threshold.query.warn. For fetch processing, also configure index.search.slowlog.threshold.fetch.warn or a suitable level. The default query/fetch thresholds are -1, which disables generation. Test with processing that exceeds the threshold and restore low test thresholds afterwards. Disabling publishing alone does not stop index log generation.
Separate healthy allocation from healthy performance
In AWS/ES, ClusterStatus.red indicates unassigned primary shards; yellow indicates missing replicas. Select ClientId, DomainName, and NodeId for node metrics and examine CPUUtilization and JVMMemoryPressure peaks. Green can coexist with slow searches. Align logs and resource evidence without treating correlation as proof of a single cause.
Align the measurement scope
This question concerns query/fetch processing on individual shards. It differs from total search-request took and user response time. A simple sum of shard logs does not establish end-to-end latency; correlate logs and metrics to choose the next investigation.