[feature request] - add dashboards for OpenSearch

[anubisg1]

As per title, would be great if you could add dashboards for OpenSearch 2.x as well.
logstash itself works the same so that piece won't be needed

[enotspe]

That is a great idea!!! I have never used Opensearch myself tough.

May I ask, why would you use Opensearch instead of Elastic?? (besides price of course). Are there any features you may consider useful for the project that we should consider??

[anubisg1]

our reasons were mostly around cost... we needed what we considered basic features, but that are behind a very steep paywall for Elastic with their X-Pack. things like AD authentication, branding, alerting via webhook.

So we looked at hopesearch and we found it to be good enough for our needs.
for fortinet2elasticsearch i would thing that the security analytics feature could be something to look into:

https://opensearch.org/docs/latest/security-analytics/index/

otherwise data ingestion is pretty straight forward. you can use the latest logstash (we use 8.5.3, but tested with 8.6.0) , just install the output plugin logstash-output-opensearch https://github.com/opensearch-project/logstash-output-opensearch and the output section of the pipeline would look like something around those lines:

output {
  opensearch {
    hosts => [ "${OS_HOSTS}" ]
    user => "${OS_USER}"
    password => "${OS_PASSWORD}"
    cacert => '/etc/logstash/certificates/ca.crt'
    ssl => true
    index => "syslog-%{+YYYY.MM.dd}"
  }

that means that all of your ingestion/parsing should remain untouched, and the only thing to look at are (possibly) index templates and definitely at the dashboards...

[enotspe]

We are considering developing Grafana dashboards for the project. Probably that would be the start for other Grafana elements, like alerts, scenes, etc. I think that would be more universal than porting to Opensearch