Elasticsearch vs OpenSearch

Elasticsearch

Keyword, dense and sparse vector, and hybrid search with rank fusion sit behind one OpenAPI-described REST API, with API keys scoped to indices and privileges. The status page lists more than 20 incidents marked major since July 2026, and Elasticsearch 9.5.0 returned incorrect results for some queries without raising an error.

OpenSearch

OpenSearch 3.9.0 runs vector, text and hybrid search under Apache-2.0, with an OpenAPI 3.1 description of its REST API and API keys limited by permission and index pattern. The owner runs the cluster, no status page or SLA comes with the software, and no tool in the MCP server sets a read-only or destructive annotation.

Elasticsearch

1. Send Authorization: ApiKey <key> to the project's Elasticsearch URL. The MCP server is on the Kibana URL at /api/agent_builder/mcp
2. Create the MCP key with feature_agentBuilder.read and only the index patterns needed, or the endpoint answers 403
3. On 429, wait and retry with exponential backoff. Do not set short client timeouts, because a retried request joins the back of the queue
4. Page past 10,000 hits with search_after, not from and size
5. Tool calls made directly through the Tools API skip Agent Builder's confirmation prompts, so restrict the key instead

OpenSearch

1. Create the index with index.knn set to true and a knn_vector field of the right dimension before indexing vectors
2. Put the filter clause inside the knn query for filtering during the search. A filter outside it runs afterwards and can return fewer than k hits
3. Ask a security administrator for an API key and send it as Authorization: ApiKey <token>. The token is shown once and lasts 90 days at most
4. Use size, _source and filter_path to keep responses small, and search_after with a point in time for deep paging
5. Set OPENSEARCH_SETTINGS_ALLOW_WRITE=false on the MCP server unless writes are needed. GenericOpenSearchApiTool can call any endpoint