Find Idle Amazon OpenSearch Service Domains

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListDomains",
      "Effect": "Allow",
      "Action": "es:ListDomainNames",
      "Resource": "*"
    },
    {
      "Sid": "DescribeDomains",
      "Effect": "Allow",
      "Action": "es:DescribeDomains",
      "Resource": "arn:aws:es:*:123456789012:domain/*"
    },
    {
      "Sid": "ReadMetrics",
      "Effect": "Allow",
      "Action": "cloudwatch:GetMetricData",
      "Resource": "*"
    }
  ]
}

// find-idle-opensearch-domains.ts
// Lists every Amazon OpenSearch Service domain (OpenSearch and legacy Elasticsearch) with its data nodes,
// dedicated master nodes, UltraWarm nodes and EBS storage, the search and indexing activity CloudWatch
// recorded over the last N days, and a rough on-demand monthly cost. Read-only: it never changes or deletes a domain.
// Usage: npx tsx find-idle-opensearch-domains.ts [--regions us-east-1,eu-west-1] [--days 14] [--csv idle-opensearch.csv]
import { writeFileSync } from "node:fs";
import { DescribeDomainsCommand, ListDomainNamesCommand, OpenSearchClient, type DomainStatus } from "@aws-sdk/client-opensearch";
import { CloudWatchClient, GetMetricDataCommand, type MetricDataQuery } from "@aws-sdk/client-cloudwatch";
import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1").split(",").map((r) => r.trim()).filter(Boolean);
const days = Math.min(Number(flag("--days") ?? 14), 14); // OpenSearch Service documents two weeks of metric history
const csvPath = flag("--csv");

// On-demand prices in us-east-1 from the AWS Price List (checked September 2026). Other Regions differ.
const INSTANCE_HOUR: Record<string, number> = {
  "t3.small.search": 0.036,
  "t3.medium.search": 0.073,
  "m5.large.search": 0.142,
  "m6g.large.search": 0.128,
  "m7g.large.search": 0.135,
  "c6g.large.search": 0.113,
  "r5.large.search": 0.186,
  "r6g.large.search": 0.167,
  "r6g.xlarge.search": 0.335,
  "r7g.large.search": 0.178,
  "or1.large.search": 0.209,
  "ultrawarm1.medium.search": 0.238,
};
const GP3_GB_MONTH = 0.122;
const HOURS_PER_MONTH = 730;

interface Row {
  Region: string;
  Domain: string;
  Engine: string;
  DataNodes: string;
  Masters: string;
  Warm: string;
  EbsGiB: number;
  Searches: number;
  IndexOps: number;
  PerMonth: string;
  Verdict: string;
}

async function describeAll(region: string): Promise<DomainStatus[]> {
  const client = new OpenSearchClient({ region });
  const { DomainNames = [] } = await client.send(new ListDomainNamesCommand({}));
  const names = DomainNames.map((d) => d.DomainName ?? "").filter(Boolean);
  const domains: DomainStatus[] = [];
  for (let i = 0; i < names.length; i += 5) { // ask for a few domains per call
    const res = await client.send(new DescribeDomainsCommand({ DomainNames: names.slice(i, i + 5) }));
    domains.push(...(res.DomainStatusList ?? []));
  }
  return domains.filter((d) => !d.Deleted);
}

async function activity(region: string, accountId: string, names: string[]): Promise<Map<string, { searches: number; indexOps: number; points: number }>> {
  const cw = new CloudWatchClient({ region });
  const end = new Date();
  const start = new Date(end.getTime() - days * 86_400_000);
  // Cluster-level metrics use the DomainName and ClientId (account ID) dimensions in the AWS/ES namespace.
  const q = (id: string, domain: string, MetricName: string): MetricDataQuery => ({
    Id: id,
    MetricStat: {
      Metric: {
        Namespace: "AWS/ES",
        MetricName,
        Dimensions: [{ Name: "DomainName", Value: domain }, { Name: "ClientId", Value: accountId }],
      },
      Period: 3_600,
      Stat: "Sum", // per-minute rates summed per hour; only zero versus non-zero matters here
    },
    ReturnData: true,
  });
  const queries = names.flatMap((n, i) => [q(`s${i}`, n, "SearchRate"), q(`x${i}`, n, "IndexingRate")]);
  const totals = new Map<string, { searches: number; indexOps: number; points: number }>();
  names.forEach((n) => totals.set(n, { searches: 0, indexOps: 0, points: 0 }));
  for (let n = 0; n < queries.length; n += 500) {
    let NextToken: string | undefined;
    do {
      const res = await cw.send(new GetMetricDataCommand({
        MetricDataQueries: queries.slice(n, n + 500), StartTime: start, EndTime: end, NextToken,
      }));
      for (const r of res.MetricDataResults ?? []) {
        const t = totals.get(names[Number(r.Id?.slice(1))]);
        if (!t) continue;
        const sum = (r.Values ?? []).reduce((a, b) => a + b, 0);
        if (r.Id?.startsWith("s")) {
          t.searches += sum;
          t.points += (r.Values ?? []).length;
        } else {
          t.indexOps += sum;
        }
      }
      NextToken = res.NextToken;
    } while (NextToken);
  }
  return totals;
}

function monthlyCost(d: DomainStatus): string {
  const c = d.ClusterConfig ?? {};
  const parts: [string | undefined, number][] = [
    [c.InstanceType, c.InstanceCount ?? 0],
    [c.DedicatedMasterEnabled ? c.DedicatedMasterType : undefined, c.DedicatedMasterEnabled ? c.DedicatedMasterCount ?? 0 : 0],
    [c.WarmEnabled ? c.WarmType : undefined, c.WarmEnabled ? c.WarmCount ?? 0 : 0],
  ];
  let total = 0;
  for (const [type, count] of parts) {
    if (!type || count === 0) continue;
    const price = INSTANCE_HOUR[type];
    if (price === undefined) return `unknown price for ${type}`;
    total += price * count * HOURS_PER_MONTH;
  }
  const ebs = d.EBSOptions;
  if (ebs?.EBSEnabled && ebs.VolumeType === "gp3") total += (ebs.VolumeSize ?? 0) * (c.InstanceCount ?? 0) * GP3_GB_MONTH;
  return `$${total.toFixed(0)}${ebs?.EBSEnabled && ebs.VolumeType !== "gp3" ? " + EBS" : ""}`;
}

async function scanRegion(region: string, accountId: string): Promise<Row[]> {
  const domains = await describeAll(region);
  if (domains.length === 0) return [];
  const names = domains.map((d) => d.DomainName ?? "");
  const totals = await activity(region, accountId, names);
  return domains.map((d) => {
    const c = d.ClusterConfig ?? {};
    const t = totals.get(d.DomainName ?? "") ?? { searches: 0, indexOps: 0, points: 0 };
    const verdict = t.points === 0 ? "no metrics: new or processing domain"
      : t.searches === 0 && t.indexOps === 0 ? "IDLE: no searches, no writes"
      : t.searches === 0 ? "WRITE-ONLY: nobody searches it"
      : "in use";
    return {
      Region: region,
      Domain: d.DomainName ?? "",
      Engine: d.EngineVersion ?? "",
      DataNodes: `${c.InstanceCount ?? 0} x ${c.InstanceType ?? "?"}`,
      Masters: c.DedicatedMasterEnabled ? `${c.DedicatedMasterCount ?? 0} x ${c.DedicatedMasterType ?? "?"}` : "-",
      Warm: c.WarmEnabled ? `${c.WarmCount ?? 0} x ${c.WarmType ?? "?"}` : "-",
      EbsGiB: d.EBSOptions?.EBSEnabled ? (d.EBSOptions.VolumeSize ?? 0) * (c.InstanceCount ?? 0) : 0,
      Searches: Math.round(t.searches),
      IndexOps: Math.round(t.indexOps),
      PerMonth: monthlyCost(d),
      Verdict: verdict,
    };
  });
}

function toCsv(rows: Row[]): string {
  const cols = Object.keys(rows[0] ?? {}) as (keyof Row)[];
  const cell = (v: string | number) => `"${String(v).replace(/"/g, '""')}"`;
  return [cols.join(","), ...rows.map((r) => cols.map((c) => cell(r[c])).join(","))].join("\n") + "\n";
}

async function main(): Promise<void> {
  const { Account = "" } = await new STSClient({ region: regions[0] }).send(new GetCallerIdentityCommand({}));
  const rows: Row[] = [];
  for (const region of regions) {
    try {
      rows.push(...(await scanRegion(region, Account)));
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  if (rows.length === 0) {
    console.log(`No OpenSearch Service domains in ${regions.join(", ")}.`);
    return;
  }
  console.table(rows);
  const idle = rows.filter((r) => r.Verdict.startsWith("IDLE"));
  console.log(`${idle.length} of ${rows.length} domains had no searches and no indexing in ${days} days.`);
  if (csvPath) {
    writeFileSync(csvPath, toCsv(rows));
    console.log(`Wrote ${rows.length} rows to ${csvPath}`);
  }
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-opensearch @aws-sdk/client-cloudwatch @aws-sdk/client-sts
npm install --save-dev tsx typescript @types/node

AWS_PROFILE=readonly npx tsx find-idle-opensearch-domains.ts --regions us-east-1,eu-west-1 --csv idle-opensearch.csv

┌─────────┬─────────────┬─────────────────┬──────────────────────┬────────────────────────┬────────────────────────┬────────────────────────────────┬────────┬──────────┬──────────┬──────────────┬──────────────────────────────────┐
│ (index) │ Region      │ Domain          │ Engine               │ DataNodes              │ Masters                │ Warm                           │ EbsGiB │ Searches │ IndexOps │ PerMonth     │ Verdict                          │
├─────────┼─────────────┼─────────────────┼──────────────────────┼────────────────────────┼────────────────────────┼────────────────────────────────┼────────┼──────────┼──────────┼──────────────┼──────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'logs-prod'     │ 'OpenSearch_2.19'    │ '3 x r6g.large.search' │ '3 x m6g.large.search' │ '-'                            │ 600    │ 184220   │ 96310455 │ '$719'       │ 'in use'                         │
│ 1       │ 'us-east-1' │ 'search-poc'    │ 'OpenSearch_2.11'    │ '2 x t3.small.search'  │ '-'                    │ '-'                            │ 40     │ 0        │ 0        │ '$57'        │ 'IDLE: no searches, no writes'   │
│ 2       │ 'us-east-1' │ 'audit-archive' │ 'OpenSearch_2.17'    │ '2 x r6g.large.search' │ '-'                    │ '2 x ultrawarm1.medium.search' │ 200    │ 0        │ 1204877  │ '$616'       │ 'WRITE-ONLY: nobody searches it' │
│ 3       │ 'eu-west-1' │ 'es-legacy'     │ 'Elasticsearch_7.10' │ '2 x m5.large.search'  │ '-'                    │ '-'                            │ 100    │ 0        │ 0        │ '$207 + EBS' │ 'IDLE: no searches, no writes'   │
└─────────┴─────────────┴─────────────────┴──────────────────────┴────────────────────────┴────────────────────────┴────────────────────────────────┴────────┴──────────┴──────────┴──────────────┴──────────────────────────────────┘
2 of 4 domains had no searches and no indexing in 14 days.
Wrote 4 rows to idle-opensearch.csv