---
title: "Connect to an OpenSearch cluster"
sidebar_label: "Connect to a cluster"
description: "How to connect to an OpenSearch cluster with an SSL certificate"
sidebar_position: 6
---
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'
# Connect to an OpenSearch cluster
To connect to an OpenSearch cluster, connect to nodes in a group with the Manager, Data, or Dashboard role. Which node you choose to connect to depends on your connection goal — for example, if you need access to the cluster dashboard, you should connect to a node from the group with the Dashboard role. More information about node groups and their roles can be found in the [Node Groups](/managed-databases/opensearch/about-node-groups.mdx) instruction.
You can:
* [connect to nodes in a group with the Manager and Data roles](#connect-to-data-and-manager) — via code with SSL;
* [connect to a node in a group with the Dashboard role](#connect-to-dashboard) — via the OpenSearch Dashboards web interface or OpenSearch API.
TLS(SSL) encryption is supported only when connecting via a private IP address.
When connecting, specify the [port](#connection-ports) and [address](#connection-addresses).
## Connection ports \{#connection-ports}
Use port 9200 to connect to cluster nodes.
## Connection addresses \{#connection-addresses}
You can choose an address for connection depending on one of the scenarios:
* [connecting to a cluster from a private subnet](#connecting-to-cluster-from-private-subnet);
* [connecting to a cluster from the internet](#connecting-to-cluster-from-internet).
You can [view the connection address](#view-connection-address) in the Control Panel.
### Connecting to a cluster from a private subnet \{#connecting-to-cluster-from-private-subnet}
If you are connecting to a cluster from a private subnet, use a private IP address.
To connect from another private subnet, first [connect both private subnets to a cloud router](/cloud-servers/cloud-networks/cloud-routers.mdx#connect-private-subnet-to-cloud-router).
### Connecting to a cluster from the internet \{#connecting-to-cluster-from-internet}
If you are connecting to a cluster from the internet, use a [public IP address](/managed-databases/opensearch/public-ip.mdx). The private subnet must meet the [requirements](/managed-databases/opensearch/public-ip.mdx#requirements). If the subnet does not meet the requirements, [prepare it for connecting a public IP address](/managed-databases/opensearch/public-ip.mdx#configure-subnet).
### View connection address \{#view-connection-address}
1. In the [Control Panel](https://my.selectel.ru/vpc/default/dbaas/), click **Products** in the top menu and select **Managed Databases**.
2. Open the **Active** tab.
3. Open the database cluster page → **Connection** tab.
4. In the **Connection addresses** block, open the tab for the node group whose addresses you want to view.
## Connect to nodes of a group with the Manager and Data roles \{#connect-to-data-and-manager}
Nodes in groups with the Manager or Data role can be connected to via SSL using only a private IP address. Connecting using TLS(SSL) encryption ensures a secure connection between your server and the database cluster.
Bash
1. Download the root certificate and place it in the `~/.opensearch/`:
```bash
mkdir -p ~/.opensearch/
wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
chmod 0600 ~/.opensearch/root.crt
```
2. Connect to the node:
```bash
curl -XGET -u 'admin:' --cacert ~/.opensearch/root.crt 'https://:/'
```
Specify:
* `` — administrator password; ;
* `` — node IP address; ;
* `` — [connection port](#connection-ports).
Python
1. Download the root certificate and place it in the `~/.opensearch/`:
```bash
mkdir -p ~/.opensearch/
wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
chmod 0600 ~/.opensearch/root.crt
```
2. Install the opensearch-py library:
```bash
pip3 install opensearch-py
```
3. Connect to the node:
```python
from opensearchpy import OpenSearch
hosts = ['',
'']
auth = ('admin', '')
ca_certs_path = '~/.opensearch/root.crt'
client = OpenSearch(
hosts,
http_auth = auth,
use_ssl = True,
verify_certs = True,
ssl_assert_hostname = False,
ssl_show_warn = False,
ca_certs = ca_certs_path
)
print(client.info())
```
Specify:
* `` and `` — node IP addresses; ;
* `` — administrator password.
Go
1. Download the root certificate and place it in the `~/.opensearch/`:
```bash
mkdir -p ~/.opensearch/
wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
chmod 0600 ~/.opensearch/root.crt
```
2. Use the connection example:
```go
package main
import (
"crypto/tls"
"crypto/x509"
"fmt"
"io/ioutil"
"github.com/opensearch-project/opensearch-go"
"net/http"
"os"
)
func main() {
caCert, err := ioutil.ReadFile("")
if err != nil {
fmt.Println("failed to read CA certificate: %w", err)
os.Exit(1)
}
caCertPool := x509.NewCertPool()
if ok := caCertPool.AppendCertsFromPEM(caCert); !ok {
fmt.Println("failed to append CA certificate")
}
client, err := opensearch.NewClient(opensearch.Config{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{RootCAs: caCertPool},
},
Addresses: []string{
"https://:",
"https://:"
},
Username: "admin",
Password: "",
})
if err != nil {
fmt.Println("cannot initialize", err)
os.Exit(1)
} else {
fmt.Println(client.Info())
}
}
```
Specify:
* `` — full path to the root certificate; ;
* `` and `` — node IP addresses; ;
* `` — [connection port](#connection-ports);;
* `` — user password.
Node.js
1. Download the root certificate and place it in the `~/.opensearch/`:
```bash
mkdir -p ~/.opensearch/
wget https://storage.dbaas.selcloud.ru/CA.pem -O ~/.opensearch/root.crt
chmod 0600 ~/.opensearch/root.crt
```
2. Install dependencies:
```bash
npm install @opensearch-project/opensearch
```
3. Use the connection example:
```js
import { readFileSync } from 'fs';
import { Client } from '@opensearch-project/opensearch';
const hosts = [
"https://:",
"https://:"
];
const username = "admin";
const password = "";
const caCertsPath = "";
const client = new Client({
nodes: hosts,
ssl: {
ca: readFileSync(caCertsPath),
},
auth: {
username,
password
}
});
const getClusterInfo = async () => {
try {
const response = await client.cluster.health();
console.log('Cluster Info:', response.body);
} catch (error) {
console.error('Error fetching cluster info:', error);
}
};
getClusterInfo();
```
Specify:
* `` and `` — node IP addresses; ;
* `` — [connection port](#connection-ports);;
* `` — administrator password; ;
* `` — full path to the root certificate.
## Connect to a group node with the Dashboard role \{#connect-to-dashboard}
OpenSearch Dashboards
You can connect to a group node with the Dashboard role through the OpenSearch Dashboards web interface.
1. Open the following page in your browser:
```
https://
```
Specify `` — IP address of a node in the group with the Dashboard role.
2. Enter the login — `admin`.
3. Enter the password — it is specified during cluster creation. Once created, the password cannot be viewed in the Control Panel, but it can be [changed](/managed-databases/opensearch/manage-users.mdx#change-administrators-password).
4. To verify the connection, run a test query in the [Dev Tools](https://opensearch.org/docs/latest/dashboards/dev-tools/index-dev/) console — for example, check the cluster status:
```graphql
GET _cluster/health
```
The response will contain information about the cluster status.
OpenSearch API
Connect to a group node with the Dashboard role and verify the connection, run a test query — for example, check the cluster status:
```curl
curl -u 'admin:' -X GET "https:///api/status"
```
Specify:
* `` — specified during cluster creation. After creation, the password cannot be viewed in the Control Panel, but it can be [changed](/managed-databases/opensearch/manage-users.mdx#change-administrators-password);
* `` — IP address of a node in the group with the Dashboard role.
The response will contain information about the cluster status.