}){kind=logo}
-
-Amazon OpenSearch Service is a managed service that makes it easy to deploy, operate, and scale OpenSearch clusters in the AWS Cloud. Amazon OpenSearch Service supports OpenSearch and legacy Elasticsearch OSS (up to 7.10, the final open source version of the software). When you create a cluster, you have the option of which search engine to use. For more details, refer to the [AWS documentation](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html).
-
-## Log and metric types
-* [CloudWatch Metrics](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html)
-* [CloudWatch Logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html)
-* [CloudTrail Logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudtrailauditing.html)
-
-## Setup
-You can collect the logs and metrics for Sumo Logic's Amazon OpenSearch Service integration by following the below steps.
-
-### Configure metrics collection
-* Collect **CloudWatch Metrics** with namespace `AWS/ES` using the [AWS Kinesis Firehose for Metrics](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source/) source. For `AWS/ES` metrics and dimensions, refer to [Amazon OpenSearch Service CloudWatch metrics](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html).
-
-### Configure logs collection
-* Collect [Amazon CloudWatch Logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html) using [AWS Kinesis Firehose for Logs](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source/) source. Amazon OpenSearch Service exposes Error logs, Slow logs and Audit logs through Amazon CloudWatch Logs. Search slow logs, indexing slow logs, and error logs are useful for troubleshooting performance and stability issues. [Audit logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/audit-logs.html) track user activity for compliance purposes.
-
-* Collect [AWS CloudTrail Logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudtrailauditing.html) using [AWS CloudTrail](/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source/) source. Amazon OpenSearch Service integrates with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in OpenSearch Service. CloudTrail captures all configuration API calls for OpenSearch Service as events. The captured calls include calls from the OpenSearch Service console, AWS CLI, or an AWS SDK. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for OpenSearch Service. Using the information collected by CloudTrail, you can determine the request that was made to OpenSearch Service, the IP address from which the request was made, who made the request, when it was made, and additional details.
\ No newline at end of file
diff --git a/docs/integrations/amazon-aws/amazon-opensearch.md b/docs/integrations/amazon-aws/amazon-opensearch.md
new file mode 100644
index 0000000000..fda0825331
--- /dev/null
+++ b/docs/integrations/amazon-aws/amazon-opensearch.md
@@ -0,0 +1,441 @@
+---
+id: amazon-opensearch
+title: Amazon OpenSearch
+description: Learn about the collection process for the Amazon OpenSearch Service.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+
+
+Amazon OpenSearch Service is a managed service that makes it easy to deploy, operate, and scale OpenSearch clusters in the AWS Cloud. An OpenSearch Service domain is synonymous with an OpenSearch cluster. Domains are clusters with the settings, instance types, instance counts, and storage resources that you specify.
+
+The Sumo Logic app for Amazon OpenSearch collects CloudWatch logs, CloudWatch metrics and CloudTrail logs, provides a unified logs and metrics app that provides insights into the operations and utilization of your OpenSearch service. The preconfigured dashboards help you monitor the key metrics by domain names and nodes, view the OpenSearch events for activities, and help you plan the capacity of your OpenSearch service.
+
+## Log and Metrics types
+
+The Sumo Logic app for Amazon OpenSearch uses:
+
+* [OpenSearch CloudWatch Logs](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html)
+* [OpenSearch CloudWatch Metrics](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudwatchmetrics.html)
+* [OpenSearch using AWS CloudTrail](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-cloudtrailauditing.html)
+
+### Sample CloudWatch log messages
+
+})
+
+### Collect CloudTrail Logs
+
+1. Add an [AWS CloudTrail Source](https://help.sumologic.com/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source/) to your Hosted Collector.
+ * **Name**. Enter a name to display for the new Source.
+ * **Description**. Enter an optional description.
+ * **S3 Region**. Select the Amazon Region for your CloudTrail S3 bucket.
+ * **Bucket Name**. Enter the exact name of your CloudTrail S3 bucket.
+ * **Path Expression**. Enter the string that matches the S3 objects you'd like to collect. You can use a wildcard (\*) in this string. (DO NOT use a leading forward slash. See [Amazon Path Expressions](/docs/send-data/hosted-collectors/amazon-aws/amazon-path-expressions)). The S3 bucket name is not part of the path. Don’t include the bucket name when you are setting the Path Expression.
+ * **Source Category**. Enter a source category. For example, enter `aws/observability/CloudTrail/logs`.
+ * **Fields**. Add an account field and assign it a value that is a friendly name/alias to your AWS account from which you are collecting logs. Logs can be queried using the account field.
+ * **Access Key ID and Secret Access Key**. Enter your Amazon [Access Key ID and Secret Access Key](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html). Learn how to use Role-based access to AWS [here](https://help.sumologic.com/docs/send-data/hosted-collectors/amazon-aws/aws-sources/).
+ * **Log File Discovery > Scan Interval**. Use the default of 5 minutes. Alternately, enter the frequency. Sumo Logic will scan your S3 bucket for new data. Learn how to configure **Log File Discovery** [here](https://help.sumologic.com/docs/send-data/hosted-collectors/amazon-aws/aws-sources/).
+ * **Enable Timestamp Parsing**. Select the **Extract timestamp information from log file entries** check box.
+ * **Time Zone**. Select **Ignore time zone from the log file and instead use**, and select **UTC** from the dropdown.
+ * **Timestamp Format**. Select **Automatically detect the format**.
+ * **Enable Multiline Processing**. Select the **Detect messages spanning multiple lines** check box, and select **Infer Boundaries**.
+2. Click **Save**.
+
+### Collect CloudWatch Metrics
+
+1. Configure a [Hosted Collector](https://help.sumologic.com/docs/send-data/hosted-collectors/configure-hosted-collector/).
+2. Configure an [Amazon CloudWatch Source for Metrics](https://help.sumologic.com/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics/) or [AWS Kinesis Firehose for Metrics Source](https://help.sumologic.com/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source/) (Recommended).
+3. **Namespaces**. Select **aws/es**.
+4. **Metadata**. Add an account field to the source and assign it a value that is a friendly name/alias to your AWS account from which you are collecting metrics. The account field allows you to query metrics.
+5. Click **Save**.
+
+### Field in Field Schema
+
+1. [Classic UI](https://help.sumologic.com/docs/get-started/sumo-logic-ui-classic/). In the main Sumo Logic menu, select **Manage Data** \> **Logs** \> **Fields**.
+ [New UI](https://help.sumologic.com/docs/get-started/sumo-logic-ui/). In the top menu select **Configuration**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**.
+2. Search for the `domainname` field.
+3. If not present, create it. Learn how to create and manage fields [here](https://help.sumologic.com/docs/manage/fields/#manage-fields).
+
+### Field Extraction Rule(s)
+
+Create a Field Extraction Rule for CloudTrail Logs. Learn how to create a Field Extraction Rule [here](https://help.sumologic.com/docs/manage/field-extractions/create-field-extraction-rule/).
+
+```sql
+Rule Name: AwsObservabilityOpenSearchCloudTrailLogsFER
+Applied at: Ingest Time
+Scope (Specific Data): account=* eventName eventSource "es.amazonaws.com"
+```
+
+```sql title="Parse Expression"
+| json "eventSource", "awsRegion", "recipientAccountId", "requestParameters.domainName" as event_source, region, accountid, domainname nodrop
+| where event_source = "es.amazonaws.com"
+| toLowerCase(domainname) as domainname
+| "aws/es" as namespace
+| fields region, namespace, domainname, accountid
+```
+
+#### Create/Update Field Extraction Rule(s) for OpenSearch CloudWatch logs
+
+```sql
+Rule Name: AwsObservabilityOpenSearchCloudWatchLogsFER
+Applied at: Ingest Time
+Scope (Specific Data):
+account=* region=* _sourceHost=/aws/OpenSearchService/*
+```
+
+```sql title="Parse Expression"
+| if (isEmpty(namespace),"unknown",namespace) as namespace
+| if (_sourceHost matches "/aws/OpenSearchService/*", "aws/es", namespace) as namespace
+| parse field=_sourceHost "/aws/OpenSearchService/domains/*/*" as domainname,logType nodrop
+| tolowercase(domainname) as domainname
+| fields namespace, domainname
+```
+
+### Centralized AWS CloudTrail Log Collection
+
+In case, you have a centralized collection of CloudTrail logs and are ingesting them from all accounts into a single Sumo Logic CloudTrail log source, create the following Field Extraction Rule to map a proper AWS account(s) friendly name/alias. Create it if not already present or update it as required.
+
+* **Rule Name**: AWS Accounts
+* **Applied at**: Ingest Time
+* **Scope (Specific Data)**: `_sourceCategory=aws/observability/cloudtrail/logs`
+* **Parse Expression**: Enter a parse expression to create an “account” field that maps to the alias you set for each sub account. For example, if you used the “dev” alias for an AWS account with ID "528560886094" and the “prod” alias for an AWS account with ID "567680881046", your parse expression would look like:
+
+```sql
+| json "recipientAccountId"
+// Manually map your aws account id with the AWS account alias you setup earlier for individual child account
+| "" as account
+| if (recipientAccountId = "528560886094", "dev", account) as account
+| if (recipientAccountId = "567680881046", "prod", account) as account
+| fields account
+```
+
+## Installing the Amazon OpenSearch app
+
+Now that you have set up a collection for **Amazon OpenSearch**, install the Sumo Logic app to use the [pre-configured dashboards](#viewing-amazon-opensearch-dashboards) that provide visibility into your environment for real-time analysis of overall usage.
+
+import AppInstall from '../../reuse/apps/app-install-v2.md';
+
+})
+
+### Performance Overview
+
+The **Amazon OpenSearch - Performance Overview** dashboard provides a comprehensive view of the OpenSearch cluster's health, performance, and resource utilization. It offers real-time insights into cluster status, CPU and memory usage, storage metrics, document management, and read/write latencies across multiple domains.
+
+Use this dashboard to:
+
+* Monitor the overall health of OpenSearch clusters with color-coded status indicators (green, yellow, or red) and quickly identify the number of clusters in each state.
+* Track resource utilization, including average CPU and JVM memory usage, both by overall and individual domain names.
+* Analyze storage trends and capacity, with graphs showing free storage space and total storage used over time for different domains.
+* Keep tabs on document management activities, including the number of searchable and deleted documents per domain.
+* Assess system performance by observing read and write latencies across various domain names, helping you to identify potential bottlenecks or areas for optimization.
+
+})
+
+### CloudTrail Audit Events
+
+The **Amazon Opensearch - CloudTrail Audit Events** dashboard provides insights across CloudTrail events across location, status, and topic names.
+
+Use this dashboard to:
+* Monitor successful and failed events by location.
+* Get trends of events by status and type.
+* Monitor successful and error events with error codes in detail.
+* Get details of domain names and users of both successful and error events.
+
+})
+
+### Audit Logs - Failed Logins
+
+The **Amazon OpenSearch - Audit Logs - Failed Logins** dashboard provides a comprehensive view of login activities, focusing on failed login attempts and authentication errors. It offers insights into the geographical distribution of failed logins, user-specific login failures, cluster-based login issues, and detailed authentication error logs.
+
+Use this dashboard to:
+* Monitor the total number of failed user logins at a glance, with a prominent display of the count.
+* Visualize the geographical distribution of failed login attempts on the map, helping identify potential security threats or unusual activity patterns from specific regions.
+* Analyze the distribution of login request methods.
+* Track failed logins by specific users and clusters, allowing for quick identification of problematic accounts or system components.
+* Review detailed authentication error logs.
+
+})
+
+### Error Logs - Garbage Collection
+
+The **Amazon OpenSearch - Error Logs - Garbage Collection** dashboard provides a comprehensive view of Garbage Collection (GC) activities in AWS OpenSearch Service. It offers insights into GC performance, memory cleanup, and JVM memory usage across different domains. The dashboard helps monitor and optimize the garbage collection process, which is crucial for maintaining the performance and stability of OpenSearch clusters.
+
+Use this dashboard to:
+
+* Monitor the average garbage collection time, by overall and domain name, with a trend graph to track changes over time.
+* Analyze average cleanup size and trends, to understand the efficiency of the garbage collection process across different domains.
+* Compare garbage collection counts across different nodes and domains, helping to identify any imbalances or potential issues in specific parts of the cluster.
+* Visualize JVM memory usage before and after garbage collection, providing insights into the effectiveness of memory management and potential memory leaks.
+
+})
+
+### Slow Logs - Queries
+
+The **Amazon Opensearch - Slow Logs - Queries** dashboard provides a comprehensive view of query performance and behavior within an OpenSearch environment.
+
+Use this dashboard to:
+* Monitor and analyze slow query performance in OpenSearch.
+* Visualize the distribution of queries over time by log type, helping to identify patterns or spikes in slow query occurrences.
+* Track query hits and shard usage over time, providing insights into overall system load and resource utilization.
+* Identify the top 10 slowest queries, including details such as index name, node ID, execution time, and query source for targeted optimization.
+
+})
+
+### Domain Name (Cluster) Performance
+
+The **Amazon OpenSearch - Domain Name (Cluster) Performance** dashboard provides a comprehensive view of cluster performance and resource utilization across different domains. It offers insights into node count, CPU and memory usage, request patterns, and storage metrics for OpenSearch clusters.
+
+Use this dashboard to:
+* Monitor the total node count and assess resource utilization with average CPU and JVM memory usage gauges, providing a quick overview of cluster health.
+* Compare CPU and JVM memory utilization across different domains (sumo, sumo-es, aws-test) using hexagon visualizations, helping to identify potential resource imbalances.
+* Track CPU and system memory utilization trends over time for each domain, allowing for the detection of performance anomalies or resource constraints.
+* Analyze OpenSearch request patterns and invalid host header requests by domain, which can help in identifying potential security issues or misconfigurations.
+* Keep an eye on cluster health indicators such as index write blocks and automated snapshot failures, ensuring data integrity and backup processes are functioning correctly.
+
+})
+
+### Nodes Performance
+
+The **Amazon OpenSearch - Nodes Performance** dashboard provides a detailed view of node-level performance metrics for OpenSearch clusters across different domains. It offers insights into search and indexing operations, threadpool activities, and overall cluster health, allowing for granular monitoring and troubleshooting of OpenSearch nodes.
+
+Use this dashboard to:
+* Compare search and indexing performance across different nodes and domains, with visualizations for search/indexing rates and latencies, helping identify potential bottlenecks or underperforming nodes.
+* Monitor thread pool activities, including search queue times, rejected requests, and write queue metrics, which are crucial for understanding cluster load and capacity issues.
+* Track OpenSearch dashboard health metrics, such as maximum response time, heap utilization, request totals, and concurrent connections, to ensure optimal performance of the user interface.
+* Analyze trends in search and indexing rates over time, allowing for the detection of patterns or anomalies that may impact cluster performance.
+* Assess overall cluster health by comparing metrics across different domains, enabling quick identification of domain-specific issues or imbalances.
+
+})
+
+### EBS Volume Performance
+
+The **Amazon OpenSearch - EBS Volume Performance** dashboard provides a comprehensive view of the performance metrics for Amazon Elastic Block Store (EBS) volumes associated with OpenSearch clusters. It displays various key performance indicators such as read and write latency, I/O operations per second (IOPS), throughput, burst balance, and disk queue depth.
+
+Use this dashboard to:
+* Monitor read and write latency of EBS volumes to ensure optimal response times for OpenSearch operations.
+* Track read and write IOPS to understand the I/O demand on your EBS volumes and identify any performance constraints.
+* Analyze read and write throughput to assess the data transfer rates and capacity utilization of your EBS volumes.
+* Keep an eye on the burst balance to ensure your EBS volumes have sufficient performance credits for handling sudden spikes in workload.
+* Observe the disk queue depth to identify potential I/O congestion and optimize your storage configuration for better performance.
+
+})
+
+### Cache Performance
+
+The **Amazon OpenSearch - Cache Performance** dashboard provides insights into cache performance, evictions, capacity, and memory usage, which are crucial for maintaining the optimal performance of OpenSearch clusters.
+
+Use this dashboard to:
+* Performance tuning of OpenSearch clusters.
+* Capacity planning for cache and memory resources.
+* Troubleshooting cache-related issues.
+* Ability to correlate cache metrics with overall system performance.
+
+})
diff --git a/docs/integrations/amazon-aws/index.md b/docs/integrations/amazon-aws/index.md
index abd89a331d..d5577a61b7 100644
--- a/docs/integrations/amazon-aws/index.md
+++ b/docs/integrations/amazon-aws/index.md
@@ -163,6 +163,13 @@ This guide has documentation for all of the apps that Sumo provides for Amazon a
A guide to our app for Amazon Kinesis - Streams.
+})
diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md
index 665a76dd6b..2ecd975c99 100644
--- a/docs/integrations/product-list/product-list-a-l.md
+++ b/docs/integrations/product-list/product-list-a-l.md
@@ -55,7 +55,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
| })
| [Amazon Inspector](https://aws.amazon.com/inspector/) | Apps:})
| [Amazon Kinesis](https://aws.amazon.com/kinesis/) | App: [Amazon Kinesis - Streams](/docs/integrations/amazon-aws/kinesis-streams/) })
| [Amazon Prometheus](https://aws.amazon.com/prometheus/) | Collector: [Amazon MSK Prometheus metrics collection](/docs/send-data/collect-from-other-data-sources/amazon-msk-prometheus-metrics-collection/) |
-| | [Amazon OpenSearch Service](https://aws.amazon.com/opensearch-service/) | App: [Amazon OpenSearch Service](/docs/integrations/amazon-aws/amazon-opensearch-service/) |
+| | [Amazon OpenSearch Service](https://aws.amazon.com/opensearch-service/) | App: [Amazon OpenSearch Service](/docs/integrations/amazon-aws/amazon-opensearch/) |
| })
| [Amazon RDS](https://aws.amazon.com/rds/) | App: [Amazon RDS](/docs/integrations/amazon-aws/rds/) })
| [Amazon Redshift](https://aws.amazon.com/pm/redshift/) | App: [Amazon Redshift ULM](/docs/integrations/amazon-aws/redshift-ulm/) |
| })
| [Amazon Route53](https://aws.amazon.com/route53/) | App: [Amazon Route53 Resolver Security](/docs/integrations/amazon-aws/route-53-resolver-security/)