O
Vector DBTier 2

OpenSearch

Policy-aware retrieval on OpenSearch k-NN with full hybrid search and regex grep support.

Search capabilities

Vector (ANN)Keyword (ranked)Keyword (filter)Hybrid (native)Grep (substring)Grep (regex)

OpenSearch k-NN: <50ms p95 on m6g instances. BM25: <20ms p95. Policy overhead <25ms p95.

sidecar metadatainline metadata

OpenSearch combines distributed BM25 text search with k-NN vector search and analytics. Gateco connects to OpenSearch as a Tier 2 retrieval connector, supporting all four search modes including ranked keyword and regex grep.

OpenSearch hybrid search is implemented via boost-based alpha weighting: a knn clause boosted by alpha×10 and a match clause boosted by (1-alpha)×10 inside a bool.should query. This approximates alpha-weighted fusion but is not mathematically identical to engines with first-class hybrid alpha (Weaviate, Qdrant).

OpenSearch supports both substring and regex grep via the Lucene query syntax. Patterns are passed to the regexp query. Lucene regex has different syntax from PCRE (no lookaheads, no backreferences).

For multi-tenant deployments, combining Gateco policy enforcement with OpenSearch index-level isolation is a common pattern. OpenSearch fine-grained access control (FGAC) can provide a database-level backstop alongside Gateco.

Sample search config

{
  "index": "knowledge_base",
  "vector_field": "embedding",
  "content_field": "content",
  "k": 10
}

Sample policy

{
  "name": "Security team access",
  "effect": "allow",
  "rules": [{
    "conditions": [
      {"field": "principal.groups", "operator": "contains", "value": "security-team"},
      {"field": "resource.classification", "operator": "in", "value": ["internal", "restricted", "public"]}
    ]
  }],
  "selectors": [{"connector_type": "opensearch"}]
}

Policy conditions reference resource.* and principal.* fields. Policy reference →

Frequently asked questions

How is OpenSearch hybrid alpha different from other connectors?
OpenSearch has no native alpha parameter. Gateco emulates it by boosting the knn clause by alpha×10 and the match clause by (1-alpha)×10 in a bool.should query. The result is comparable to alpha-weighted fusion but approximate.
Does Gateco support Amazon OpenSearch Service?
Yes. Connect using the OpenSearch domain endpoint, with AWS Signature v4 signing if using fine-grained access control, or username/password for internal users. Credentials are stored encrypted in Gateco.
Can I use OpenSearch FGAC alongside Gateco?
Yes. OpenSearch fine-grained access control provides a database-level backstop. Gateco policies operate on top of whatever documents the service credential can retrieve, adding principal-context enforcement and audit logging.

Ready to connect OpenSearch?

Follow the step-by-step setup guide or talk to the team for help with your specific configuration.

Setup guide →Talk to the teamAll integrations