# Last9 vs OpenSearch: An OpenSearch Alternative in Your Cloud

> Last9 vs OpenSearch compared on AI and MCP, who runs the cluster, pricing and support, log field limits, metrics and PromQL, APM, real user and synthetic monitoring, and full-text search, with where each one fits.

Source: https://last9.io/compare/opensearch/

Both have an AI agent and an MCP server. Last9 runs its agent on your model provider and hosts its MCP server, inside your own cloud account, on one licence, and Last9 runs the platform for you. OpenSearch is an open-source search engine that your team or AWS runs, and it sends metrics queries to a separate Prometheus.

- **Gartner Cool Vendor 2025:** Named a Gartner® Cool Vendor in AI for SRE and Observability, cited for its unified telemetry platform.
- **Your model, your cloud:** The Last9 agent runs on your model provider, with no per-investigation charge, in your own cloud account.
- **One licence:** No instance-hour or OCU-hour meters, and no cluster to size. The infrastructure runs on your own cloud bill.

## Last9 vs OpenSearch at a glance

The questions engineering teams ask when they compare the two.

| | **Last9** | **OpenSearch** |
|---|---|---|
| Is there an AI SRE agent that investigates incidents? | ✓ Yes, generally available. The Last9 agent responds to pages | On AWS only, in OpenSearch UI, since March 2026. Self-managed, your team builds one |
| Which model does the AI run on? | ✓ Your model provider. Customer data is never used for training | On AWS, a Bedrock model that AWS picks, with usage limits per account |
| Does it have an MCP server for coding agents? | ✓ Yes, hosted, since March 2025. An agent can act through it: add drop rules and edit dashboards | Yes, since 2025. Your team runs it, or deploys it on AWS from a template |
| Who operates the cluster? | ✓ Last9 does, in your own cloud account, on AWS or GCP in any region | Your team. Even on Amazon OpenSearch Service, it sizes instances and shards |
| How is it priced? | ✓ One licence. The infrastructure runs on your own cloud bill | Instance-hours and storage, or OCU-hours on Serverless. Self-managed is free, and your team runs it |
| What support comes with it? | ✓ A shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers | An AWS Support plan, billed separately. Self-managed, the community forum |
| How many fields can a log carry? | ✓ No field limit | 1,000 per index by default, raised by a setting |
| Where do metrics and PromQL queries run? | ✓ In Last9, natively. No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name | In a separate Prometheus, which OpenSearch queries with PromQL |
| How deep does APM go? | ✓ Apdex, exceptions, database and external calls, and service maps, from OpenTelemetry | Latency, errors, and a service map, since OpenSearch 3.6. No Apdex or exceptions view |
| Does it cover real user and synthetic monitoring? | ✓ Yes. RUM for web and mobile, and HTTP synthetic checks | Neither. A synthetics request was closed as not planned |
| What about our APM agents and integrations? | OpenTelemetry-native, with 100+ integrations. Fluent Bit and Logstash forward logs | OpenTelemetry, through Data Prepper or OpenSearch Ingestion |
| What about full-text search, vector search, and security data? | Log search with the builder, LogQL, or plain English | ✓ Full-text and vector search on Lucene, with Security Analytics, under Apache 2.0 |

## AI on your model, in your cloud

- **Last9:** One assistant in the app, in Slack, and in your IDE through MCP. It investigates, builds a diagnosis dashboard, and hands you the link.
- **Last9:** The production agent, Last9, responds to pages with context from Slack, Linear, and PagerDuty. It runs on your model provider or inference endpoint and picks the model for each step. Customer data is never used for training.
- **Last9:** An agent can do more than read. Through the hosted MCP server it can add a drop rule and stop ingesting the noisy source it found.
- **Last9:** Click a point on a chart, a table row, an alert, or an exception, and choose Ask Last9 AI. The investigation starts from that value, in its service context.
- **OpenSearch:** On Amazon OpenSearch Service, Ask AI and the Investigation Agent run in OpenSearch UI on a Bedrock model that AWS provides, with token-based usage limits. Self-managed OpenSearch ships ML Commons agents and an MCP server that your team configures and runs.

## Managed in your cloud, on one licence

- **Last9:** Last9 runs single-tenant in your own cloud account, on AWS or GCP in any region, and manages it for you. Last9 sizes the cluster, tunes it, and runs the upgrades.
- **Last9:** One licence covers distributed tracing, profiling, custom metrics, custom dashboards, alerting, RBAC, and forward deployed engineers. The infrastructure runs on your own cloud bill, at your negotiated rates.
- **Last9:** Support is a shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers who know your setup.
- **OpenSearch:** Self-managed OpenSearch is free, and your team operates it. Amazon OpenSearch Service replaces failed nodes, while your team picks instance types and storage and plans shards within a per-node limit. It bills by instance-hour and storage, or by OCU-hour on Serverless.

## Metrics, logs, and traces in one backend

- **Last9:** Metrics live next to logs and traces, and PromQL runs on them natively. No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name.
- **Last9:** No field limit on logs. New attributes from a new service or a new release stay queryable, with no mapping to raise.
- **Last9:** PromQL and LogQL natively, with a builder and plain-English Ask Mode for anyone who does not write queries. Your own Grafana can also query Last9 metrics as a Prometheus data source.
- **Last9:** APM starts from your services: discovery, dependency maps, database and external calls, Apdex, exceptions, and trace correlation, from OpenTelemetry.
- **Last9:** Real user monitoring for web, Android, iOS, React Native, and Flutter, HTTP synthetic checks, and Agents Monitoring for your LLM and agent calls, on the one licence.
- **OpenSearch:** OpenSearch stores logs and traces, and passes PromQL to a separate Prometheus or Amazon Managed Service for Prometheus. Its APM has no Apdex or exceptions view, and it has no real user or synthetic monitoring. Each index maps 1,000 fields by default, and logs are queried in Query DSL, SQL, PPL, DQL, or Lucene.
- **Tradeoff:** OpenSearch indexes every field for full-text search and scores matches by relevance. Test both on the log searches your team runs most.

## Which one fits your team?

**Choose Last9 if:**
- You want an AI agent on your own model provider, with no charge per investigation
- Your team spends hours on shards, instance sizes, and blue/green changes, and wants the backend managed in your own cloud account
- You want metrics, logs, and traces in one backend, with PromQL that runs natively
- Your logs carry more fields than one index mapping allows
- You want one licence instead of instance-hour and OCU-hour meters

**Choose OpenSearch if:**
- Full-text or vector search with relevance scoring is your main workflow
- You want security analytics on the same data as your logs
- You want an Apache 2.0 engine that you run yourself, anywhere
- Your dashboards, alerts, and runbooks depend on PPL and Query DSL

## Moving off OpenSearch

What the switch involves, and what Last9 does for you.

- **Forward deployed engineers:** A Last9 engineer runs the move with your team.
- **Keep your instrumentation:** Services on OpenTelemetry SDKs already send OTLP, so they need only a new endpoint in the OpenTelemetry Collector. Fluent Bit and Logstash forward logs to Last9, with your parsing intact.
- **Queries without PPL:** A Last9 engineer moves your dashboards and alerts with your team, and rewrites PPL and Query DSL queries in PromQL or LogQL. Anyone who does not write queries uses the builder or plain-English Ask Mode.
- **Run both:** Keep OpenSearch for full-text search, vector search, and Security Analytics, and move your Kubernetes and OpenTelemetry services to Last9. The OpenTelemetry Collector can send the same data to both while you compare them on your own incidents.

## The objections we hear most

Each one is a fair reason to hesitate.

### AWS already has an Investigation Agent for OpenSearch. Why switch for AI?

The difference is the model, the place it runs, and the reach. The AWS agent runs in OpenSearch UI on a Bedrock model that AWS provides, with usage limits for each account. The Last9 agent is generally available, runs on your model provider in your own cloud account, and has no per-investigation charge.

### Amazon OpenSearch Service already runs the cluster for us.

AWS replaces failed nodes, but your team still picks the instance types, storage, and shards. Last9 runs in your own cloud account and manages it for you.

### OpenSearch is open source and free.

The licence is free, and the instances, storage, and engineering hours that run it are not. Last9 is one licence, the infrastructure runs on your own cloud bill, and Last9 operates the platform.

### We already pay for AWS Support.

Last9 support is a shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers on the account. The engineers who run your migration stay on the account afterwards, so they already know your setup.

### Is Last9 proven at our scale?

Last9 regularly handles 500M+ events a minute and 60M+ concurrent users, and has monitored 12 of the world's 20 largest streaming events. It is SOC 2 Type II certified and PCI ready, with SSO and access controls. Teams across fintech, healthcare, gaming, media, and commerce run it in production, including Replit, Pine Labs, Tata 1mg, and Housing.com.

## FAQ

### Is Last9 a good choice among OpenSearch alternatives?

OpenSearch fits teams whose main workflow is full-text or vector search, who want security analytics on the same data, or who want an Apache 2.0 engine they run themselves. Last9 fits teams that want an AI agent on their own model provider, a backend that Last9 manages in their own cloud account, metrics and logs in one place with no field limit, and one licence instead of meters.

### How does Last9's MCP server compare with the OpenSearch MCP server?

The OpenSearch MCP server is open source and runs where your team deploys it, and the built-in server in OpenSearch 3.x is off by default until an admin registers its tools. Last9's hosted MCP server works with any MCP client, such as Claude Code or Cursor, has been available since March 2025, and lets an agent act on what it finds: add drop rules to change what is ingested, and edit dashboards.

### How does Last9's AI compare with OpenSearch AI?

On Amazon OpenSearch Service, Ask AI and the Investigation Agent run in OpenSearch UI on a Bedrock model that AWS provides, with token-based usage limits for each account. Self-managed OpenSearch ships ML Commons agents that your team builds into an assistant. The Last9 agent is generally available, has no per-query or per-investigation charge, and runs on your model provider inside your own cloud account.

### How does Last9 billing compare with AWS OpenSearch pricing?

AWS OpenSearch pricing bills instance-hours and storage on managed domains, and OCU-hours on Serverless and OpenSearch Ingestion, with AWS Support billed separately. Self-managed OpenSearch is free, and your team pays to run it. Last9 is one licence, and the infrastructure runs on your own cloud bill at your negotiated rates.

### How does Last9 compare with OpenSearch observability?

OpenSearch observability stores logs and traces in OpenSearch, and passes PromQL to a separate Prometheus or Amazon Managed Service for Prometheus, where its APM keeps RED metrics. Last9 stores metrics, logs, and traces together, answers PromQL natively, and has no hard cardinality limit: 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name.

### How does Last9 handle the limits that AWS OpenSearch puts on fields and shards?

AWS OpenSearch maps 1,000 fields per index by default, and managed domains cap shards per node by heap, a default that cannot be changed. Last9 has no field limit on logs and no shards for your team to plan, so new attributes stay queryable as services change.

### Is there an AWS OpenSearch alternative that runs in our cloud account?

Yes. AWS OpenSearch runs domains that AWS manages and your team sizes, and self-managed OpenSearch runs in your account, operated by your team. Last9 runs single-tenant in your own cloud account, on AWS or GCP in any region, and Last9 manages it for you, including the AI.

### Can Last9 replace OpenSearch APM?

OpenSearch APM arrived in OpenSearch 3.6 and shows latency, errors, and a dependency map, with no Apdex or exceptions view, and it keeps its RED metrics in a separate Prometheus. Last9 covers service discovery, dependency maps, database and external calls, Apdex, exceptions, and trace correlation, from OpenTelemetry, on the one licence.

### Can Last9 run alongside OpenSearch?

Yes. OpenSearch is a full-text and vector search engine with Security Analytics, so keep it for search and security, and move your Kubernetes and OpenTelemetry services to Last9. The OpenTelemetry Collector can send the same data to both, and a Last9 engineer plans the split with your team.

### How do I migrate from OpenSearch to Last9?

Services on OpenTelemetry SDKs already send OTLP, so they need only a new endpoint, and Fluent Bit and Logstash forward logs to Last9. A Last9 engineer moves your dashboards and alerts with your team, and rewrites PPL and Query DSL queries in PromQL or LogQL.