OpenSearch Dashboards provides a familiar visual interface for exploring data, building charts, and assembling interactive dashboards. Although it is normally paired with OpenSearch, you can also connect it directly to Manticore Search.

The integration lets you keep Manticore as the search and analytics backend while using Discover, Visualize, and Dashboards as the user interface. This is especially useful for log and event data: tools such as Logstash, Filebeat, Fluent Bit, and Vector can send data to Manticore, while OpenSearch Dashboards gives your team a convenient way to inspect it.

In this tutorial, we will configure the connection, add a small sample dataset, explore it in Discover, and create a visualization.

How the integration works

OpenSearch Dashboards communicates with its backend through an HTTP API. Manticore exposes a compatible API on its HTTP listener, which uses port 9308 by default.

The compatibility layer is provided by the EmulateElastic plugin in Manticore Buddy . It handles the requests that OpenSearch Dashboards needs for startup, index discovery, searches, filters, and supported aggregations. Buddy normally starts automatically with searchd, so a standard Manticore installation already has the required component.

This is an API compatibility integration, not an embedded OpenSearch cluster. Manticore stores and queries the data, and OpenSearch Dashboards provides the visual interface.

Prerequisites

For this walkthrough, you need:

• A running Manticore Search instance with its HTTP endpoint available at http://localhost:9308
• Manticore Buddy installed and running
• OpenSearch Dashboards 3.4.0, the currently tested and recommended version
• Manticore running in real-time mode

Other OpenSearch Dashboards versions may work, but they have not been tested to the same extent. The version reported by Manticore must also match the version of OpenSearch Dashboards.

Step 1: Configure Manticore

Open your Manticore configuration file and make sure that the HTTP listener is enabled. Set kibana_version_string to the version of OpenSearch Dashboards that you plan to run:

searchd {
    listen = 127.0.0.1:9308:http
    pid_file = /var/run/manticore/searchd.pid
    data_dir = /var/lib/manticore
    kibana_version_string = 3.4.0
}

The name kibana_version_string is retained for compatibility with the existing Elasticsearch-style API. OpenSearch Dashboards checks the backend version during startup, so a mismatch can produce warnings or prevent the application from starting.

Restart Manticore after changing the configuration.

If Manticore and OpenSearch Dashboards run on different hosts or in different containers, do not bind the HTTP listener only to 127.0.0.1. Bind it to an address that OpenSearch Dashboards can reach, and restrict access with your network or firewall configuration.

Step 2: Configure OpenSearch Dashboards

Open opensearch_dashboards.yml. In a tarball installation , it is usually located at config/opensearch_dashboards.yml; packages may place it at /etc/opensearch-dashboards/opensearch_dashboards.yml.

Point opensearch.hosts to Manticore's HTTP endpoint:

opensearch.hosts: ["http://localhost:9308"]

Manticore does not provide the OpenSearch Security plugin. The corresponding Dashboards plugin must therefore be disabled.

For a tarball installation, stop OpenSearch Dashboards and remove the plugin:

./bin/opensearch-dashboards-plugin remove securityDashboards

If you run OpenSearch Dashboards in Docker, provide both settings through environment variables:

environment:
  OPENSEARCH_HOSTS: '["http://manticore:9308"]'
  DISABLE_SECURITY_DASHBOARDS_PLUGIN: "true"

Here, manticore is the hostname or container name reachable from the OpenSearch Dashboards container. Using localhost inside that container would refer to the container itself, not to Manticore.

Start OpenSearch Dashboards and open http://localhost:5601 .

Step 3: Add sample data to Manticore

If you already have a real-time table, you can skip this step. Otherwise, connect to Manticore through its MySQL-compatible port:

mysql -h127.0.0.1 -P9306

Create a table for a small set of application events:

CREATE TABLE app_events (
    message text,
    service string,
    status_code uint,
    response_time float,
    event_time timestamp
);

Add a few documents:

INSERT INTO app_events
    (message, service, status_code, response_time, event_time)
VALUES
    ('Request completed', 'catalog', 200, 0.12, 1786924800),
    ('Request completed', 'checkout', 200, 0.31, 1786928400),
    ('Upstream timeout', 'checkout', 504, 2.75, 1786932000),
    ('Product not found', 'catalog', 404, 0.08, 1786935600),
    ('Request completed', 'catalog', 200, 0.15, 1786939200),
    ('Payment rejected', 'payments', 422, 0.44, 1786942800);

This schema gives us text to search, dimensions to group by, metrics to aggregate, and a timestamp for time-based charts.

Step 4: Create an index pattern

OpenSearch Dashboards uses an index pattern to select the data source shown in Discover and visualizations. In this integration, the pattern matches a Manticore table name.

1. Open Management > Dashboards Management.
2. Go to Index Patterns and choose Create index pattern.
3. Enter app_events.
4. Select event_time as the time field.
5. Save the index pattern.

The app_events fields should now be available in OpenSearch Dashboards.

Step 5: Explore the data in Discover

Open Discover and select the app_events index pattern. You can now:

• Inspect individual documents
• Search the message field
• Filter by fields such as service or status_code
• Change the time range
• Add and remove columns from the results

For example, add a filter where status_code is greater than or equal to 400 to focus on failed requests. You can then add service, message, status_code, and response_time as columns to get a compact error view.

Simple Dashboard Query Language searches work with the integration. Advanced DQL features—including nested field searches, regular expressions, fuzzy searches, proximity searches, and term boosting—may not be compatible with Manticore.

Step 6: Build a visualization

Open Visualize, create a new visualization, and choose the app_events index pattern. OpenSearch Dashboards can use the following bucket aggregations with Manticore:

• terms
• histogram
• date_histogram
• range
• date_range

Supported metric aggregations include:

• max
• min
• sum
• avg

As a first chart, create a bar chart of events by service:

1. Use Count as the metric.
2. Add a Terms bucket using the service field.
3. Apply the changes.
4. Save the visualization as Events by service.

You can also create a time-series chart with a Date Histogram on event_time, or chart average latency by using the avg metric on response_time.

After saving your visualizations, open Dashboards, create a dashboard, and add them. Filters applied at dashboard level let you focus the whole view on one service, status code, or time range.

What is supported

The integration covers the main data exploration workflow:

• Searching and filtering documents in Discover
• Creating index patterns for Manticore tables
• Building visualizations with supported bucket and metric aggregations
• Saving visualizations and combining them into dashboards
• Managing index patterns and saved objects in Dashboards Management

Manticore also emulates the stack-level requests needed during OpenSearch Dashboards startup, including node version information, cluster settings, configuration objects, and index listings.

Current limitations

OpenSearch Dashboards includes many features that depend on OpenSearch-specific APIs or field types. Those features are outside the scope of this integration.

Unsupported field types include:

• Geographic and Cartesian fields such as geo_point, geo_shape, xy_point, and xy_shape
• Range types such as integer_range, ip_range, and date_range
• Specialized search types such as semantic, rank_feature, and percolator
• OpenSearch vector types such as knn_vector and sparse_vector
• Relational types such as nested and join
• Advanced string types such as completion and search_as_you_type

Plain text and keyword fields are supported. Manticore's own vector search remains available through its SQL and JSON APIs, but OpenSearch Dashboards cannot represent it through OpenSearch's vector field type.

Nested aggregations—an aggs block inside another aggs block—are not supported. Metric functions are limited to those implemented by Manticore.

OpenSearch-specific applications and administration tools are also not available, including:

• Geospatial visualizations
• Observability and trace analytics
• Alerting and Anomaly Detection
• Security Analytics
• Index State Management and Index Management
• Performance Analyzer
• OpenSearch Security plugin workflows

These limitations do not affect the core Discover, visualization, and dashboard workflow described above.

Bringing in real data

Once the connection works, you can replace the sample table with your own data pipeline. Manticore integrates with Logstash , Filebeat , Fluent Bit , and Vector . These tools can collect and transform logs or events before sending them to Manticore's Elasticsearch-compatible HTTP endpoint.

The resulting workflow is straightforward:

1. An agent or pipeline collects your data.
2. Manticore indexes it in real time.
3. OpenSearch Dashboards queries Manticore over HTTP.
4. Users explore the data and build dashboards in a familiar interface.

Conclusion

The OpenSearch Dashboards integration gives Manticore users a practical visual layer for log analysis and data exploration. With a small amount of configuration, you can search documents in Discover, build charts from supported aggregations, and combine them into dashboards while Manticore handles storage and query execution.

For the latest compatibility details and configuration notes, see the OpenSearch Dashboards integration documentation .