Skip to main content
idle · aws

OpenSearch domains with no queries, no indexing and no CPU for 30 days

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags an OpenSearch domain only when SearchRate and IndexingRate both sit below 0.10 per minute and CPU stays under 5% across 30 days of full coverage. A query-less domain that is still ingesting documents is treated as in use, and any missing series makes the rule abstain.

Signal and threshold

How ZopNight evaluates OpenSearch domains with no queries, no indexing and no CPU for 30 days.
Field Value
Rule IDsRC-104
Categoryidle
Severitymedium
Metricnone — pure configuration read
Sourceopensearch_idle.go

Zero queries is not enough

Plenty of OpenSearch domains answer no searches and still work for a living: log-archive sinks and ingest pipelines write documents all day without a single query arriving. For a destructive “this domain is unused” finding, query silence is necessary but nowhere near sufficient. The rule therefore demands three independent axes from the domain metrics OpenSearch Service publishes go quiet together: SearchRate, IndexingRate, and CPUUtilization. The last one catches domains that burn cycles on segment merges or replication despite no external traffic at all.

The exact floors

AxisFloorApplies to
SearchRatebelow 0.10 per minuteAverage and Maximum
IndexingRatebelow 0.10 per minuteAverage and Maximum
CPUUtilizationbelow 5%Average and Maximum

The 0.10 floors are expressed in the metrics’ native per-minute units, which makes them a deliberately tight bound of under 6 requests per hour. They are floors rather than hard zeros because these series carry trace noise (health-probe queries, internal housekeeping) on domains that are functionally dead.

Coverage matters as much as the value

Each series must actually cover the full 30 days, not merely read low. A thinly covered CPU series can coincidentally sit near zero during a partial window (mid instance-type change, or halfway through a blue-green cycle), and a month of inactivity cannot be proven from a week of data.

Every exit follows that fail-closed pattern: any of the three series missing, any axis at or above its floor, any window shorter than 30 days, or no resolved run-rate: each produces no finding rather than a hedged one.

Ask CloudWatch directly

Terminal window
aws cloudwatch get-metric-statistics \
--namespace AWS/ES --metric-name SearchRate \
--dimensions Name=DomainName,Value=my-domain Name=ClientId,Value=123456789012 \
--start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \
--end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--period 86400 --statistics Average Maximum

ClientId is your account ID; OpenSearch publishes its CloudWatch metrics under both dimensions. Repeat for IndexingRate and CPUUtilization.

The bill an idle domain keeps paying

An OpenSearch domain bills its full provisioned run-rate (instance node-hours times node count, plus EBS standing storage) whether it serves a thousand queries or none. The recoverable saving is that entire figure. Take a manual snapshot to S3 first, then delete the domain, or downsize the instance type and count if the workload shrank rather than vanished.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·