Why engineering teams choose Last9 vs OpenSearch
Both have an AI agent and an MCP server. Last9 runs its agent on your model provider and hosts its MCP server, inside your own cloud account, on one licence, and Last9 runs the platform for you. OpenSearch is an open-source search engine that your team or AWS runs, and it sends metrics queries to a separate Prometheus.
100+ native integrations, OpenTelemetry-first. A Last9 engineer runs the move with your team.
Named a Gartner® Cool Vendor in AI for SRE and Observability, cited for its unified telemetry platform.
The Last9 agent runs on your model provider, with no per-investigation charge, in your own cloud account.
No instance-hour or OCU-hour meters, and no cluster to size. The infrastructure runs on your own cloud bill.
At a glance
Last9 vs OpenSearch at a glance
The questions engineering teams ask when they compare the two.
Is there an AI SRE agent that investigates incidents?
Yes, generally available. The Last9 agent responds to pages
On AWS only, in OpenSearch UI, since March 2026. Self-managed, your team builds one
Which model does the AI run on?
Your model provider. Customer data is never used for training
On AWS, a Bedrock model that AWS picks, with usage limits per account
Does it have an MCP server for coding agents?
Yes, hosted, since March 2025. An agent can act through it: add drop rules and edit dashboards
Yes, since 2025. Your team runs it, or deploys it on AWS from a template
Who operates the cluster?
Last9 does, in your own cloud account, on AWS or GCP in any region
Your team. Even on Amazon OpenSearch Service, it sizes instances and shards
How is it priced?
One licence. The infrastructure runs on your own cloud bill
Instance-hours and storage, or OCU-hours on Serverless. Self-managed is free, and your team runs it
What support comes with it?
A shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers
An AWS Support plan, billed separately. Self-managed, the community forum
How many fields can a log carry?
No field limit
1,000 per index by default, raised by a setting
Where do metrics and PromQL queries run?
In Last9, natively. No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name
In a separate Prometheus, which OpenSearch queries with PromQL
How deep does APM go?
Apdex, exceptions, database and external calls, and service maps, from OpenTelemetry
Latency, errors, and a service map, since OpenSearch 3.6. No Apdex or exceptions view
Does it cover real user and synthetic monitoring?
Yes. RUM for web and mobile, and HTTP synthetic checks
Neither. A synthetics request was closed as not planned
What about our APM agents and integrations?
OpenTelemetry-native, with 100+ integrations. Fluent Bit and Logstash forward logs
OpenTelemetry, through Data Prepper or OpenSearch Ingestion
What about full-text search, vector search, and security data?
Log search with the builder, LogQL, or plain English
Full-text and vector search on Lucene, with Security Analytics, under Apache 2.0
| Capability | Last9 | OpenSearch |
|---|---|---|
| Is there an AI SRE agent that investigates incidents? | Yes, generally available. The Last9 agent responds to pages | On AWS only, in OpenSearch UI, since March 2026. Self-managed, your team builds one |
| Which model does the AI run on? | Your model provider. Customer data is never used for training | On AWS, a Bedrock model that AWS picks, with usage limits per account |
| Does it have an MCP server for coding agents? | Yes, hosted, since March 2025. An agent can act through it: add drop rules and edit dashboards | Yes, since 2025. Your team runs it, or deploys it on AWS from a template |
| Who operates the cluster? | Last9 does, in your own cloud account, on AWS or GCP in any region | Your team. Even on Amazon OpenSearch Service, it sizes instances and shards |
| How is it priced? | One licence. The infrastructure runs on your own cloud bill | Instance-hours and storage, or OCU-hours on Serverless. Self-managed is free, and your team runs it |
| What support comes with it? | A shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers | An AWS Support plan, billed separately. Self-managed, the community forum |
| How many fields can a log carry? | No field limit | 1,000 per index by default, raised by a setting |
| Where do metrics and PromQL queries run? | In Last9, natively. No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name | In a separate Prometheus, which OpenSearch queries with PromQL |
| How deep does APM go? | Apdex, exceptions, database and external calls, and service maps, from OpenTelemetry | Latency, errors, and a service map, since OpenSearch 3.6. No Apdex or exceptions view |
| Does it cover real user and synthetic monitoring? | Yes. RUM for web and mobile, and HTTP synthetic checks | Neither. A synthetics request was closed as not planned |
| What about our APM agents and integrations? | OpenTelemetry-native, with 100+ integrations. Fluent Bit and Logstash forward logs | OpenTelemetry, through Data Prepper or OpenSearch Ingestion |
| What about full-text search, vector search, and security data? | Log search with the builder, LogQL, or plain English | Full-text and vector search on Lucene, with Security Analytics, under Apache 2.0 |
Differences
Where Last9 and OpenSearch differ
Three places the two platforms take a different approach, with the tradeoffs stated.
AI on your model, in your cloud
-
One assistant in the app, in Slack, and in your IDE through MCP. It investigates, builds a diagnosis dashboard, and hands you the link.
-
The production agent, Last9, responds to pages with context from Slack, Linear, and PagerDuty. It runs on your model provider or inference endpoint and picks the model for each step. Customer data is never used for training.
-
An agent can do more than read. Through the hosted MCP server it can add a drop rule and stop ingesting the noisy source it found.
-
Click a point on a chart, a table row, an alert, or an exception, and choose Ask Last9 AI. The investigation starts from that value, in its service context.
OpenSearch
On Amazon OpenSearch Service, Ask AI and the Investigation Agent run in OpenSearch UI on a Bedrock model that AWS provides, with token-based usage limits. Self-managed OpenSearch ships ML Commons agents and an MCP server that your team configures and runs.
Managed in your cloud, on one licence
-
Last9 runs single-tenant in your own cloud account, on AWS or GCP in any region, and manages it for you. Last9 sizes the cluster, tunes it, and runs the upgrades.
-
One licence covers distributed tracing, profiling, custom metrics, custom dashboards, alerting, RBAC, and forward deployed engineers. The infrastructure runs on your own cloud bill, at your negotiated rates.
-
Support is a shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers who know your setup.
OpenSearch
Self-managed OpenSearch is free, and your team operates it. Amazon OpenSearch Service replaces failed nodes, while your team picks instance types and storage and plans shards within a per-node limit. It bills by instance-hour and storage, or by OCU-hour on Serverless.
Metrics, logs, and traces in one backend
-
Metrics live next to logs and traces, and PromQL runs on them natively. No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name.
-
No field limit on logs. New attributes from a new service or a new release stay queryable, with no mapping to raise.
-
PromQL and LogQL natively, with a builder and plain-English Ask Mode for anyone who does not write queries. Your own Grafana can also query Last9 metrics as a Prometheus data source.
-
APM starts from your services: discovery, dependency maps, database and external calls, Apdex, exceptions, and trace correlation, from OpenTelemetry.
-
Real user monitoring for web, Android, iOS, React Native, and Flutter, HTTP synthetic checks, and Agents Monitoring for your LLM and agent calls, on the one licence.
OpenSearch
OpenSearch stores logs and traces, and passes PromQL to a separate Prometheus or Amazon Managed Service for Prometheus. Its APM has no Apdex or exceptions view, and it has no real user or synthetic monitoring. Each index maps 1,000 fields by default, and logs are queried in Query DSL, SQL, PPL, DQL, or Lucene.
Tradeoff
OpenSearch indexes every field for full-text search and scores matches by relevance. Test both on the log searches your team runs most.
Which fits you
Which one fits your team?
Choose Last9 if
- You want an AI agent on your own model provider, with no charge per investigation
- Your team spends hours on shards, instance sizes, and blue/green changes, and wants the backend managed in your own cloud account
- You want metrics, logs, and traces in one backend, with PromQL that runs natively
- Your logs carry more fields than one index mapping allows
- You want one licence instead of instance-hour and OCU-hour meters
Choose OpenSearch if
- Full-text or vector search with relevance scoring is your main workflow
- You want security analytics on the same data as your logs
- You want an Apache 2.0 engine that you run yourself, anywhere
- Your dashboards, alerts, and runbooks depend on PPL and Query DSL
Migration
Moving off OpenSearch
What the switch involves, and what Last9 does for you.
Forward deployed engineers
A Last9 engineer runs the move with your team.
Talk to an engineerKeep your instrumentation
Services on OpenTelemetry SDKs already send OTLP, so they need only a new endpoint in the OpenTelemetry Collector. Fluent Bit and Logstash forward logs to Last9, with your parsing intact.
Forward logs from Fluent BitQueries without PPL
A Last9 engineer moves your dashboards and alerts with your team, and rewrites PPL and Query DSL queries in PromQL or LogQL. Anyone who does not write queries uses the builder or plain-English Ask Mode.
Run both
Keep OpenSearch for full-text search, vector search, and Security Analytics, and move your Kubernetes and OpenTelemetry services to Last9. The OpenTelemetry Collector can send the same data to both while you compare them on your own incidents.
Objections
The objections we hear most
Each one is a fair reason to hesitate.
AWS already has an Investigation Agent for OpenSearch. Why switch for AI?
The difference is the model, the place it runs, and the reach. The AWS agent runs in OpenSearch UI on a Bedrock model that AWS provides, with usage limits for each account. The Last9 agent is generally available, runs on your model provider in your own cloud account, and has no per-investigation charge.
Amazon OpenSearch Service already runs the cluster for us.
AWS replaces failed nodes, but your team still picks the instance types, storage, and shards. Last9 runs in your own cloud account and manages it for you.
OpenSearch is open source and free.
The licence is free, and the instances, storage, and engineering hours that run it are not. Last9 is one licence, the infrastructure runs on your own cloud bill, and Last9 operates the platform.
We already pay for AWS Support.
Last9 support is a shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers on the account. The engineers who run your migration stay on the account afterwards, so they already know your setup.
Is Last9 proven at our scale?
Last9 regularly handles 500M+ events a minute and 60M+ concurrent users, and has monitored 12 of the world's 20 largest streaming events. It is SOC 2 Type II certified and PCI ready, with SSO and access controls. Teams across fintech, healthcare, gaming, media, and commerce run it in production, including Replit, Pine Labs, Tata 1mg, and Housing.com.
67%
Average reduction in observability costs
2.5x
More telemetry retained without sampling
100+
Native integrations, OpenTelemetry-first
24x7
Support from forward deployed engineers
Customers
What do Last9 customers say?
With Last9, we just eliminated the toil. No more worrying about failing dashboards or alerts — we can finally use our metrics. It just works.
Last9 allowed us to offload the operational overhead of scaling so we could focus on business alerting rather than infrastructure management.
Frequently asked questions
Ask AI about this comparison
Do not take our word for it. Send the question to an assistant and check what it finds.
Can't find the answer to your question?
Talk to our support team for help.
Start observing for free. No lock-in.
OpenTelemetry · Prometheus
Just update your config. Start seeing data on Last9 in seconds.
Datadog · New Relic · Others
We've got you covered. Bring over your dashboards & alerts in one click.
Built on Open Standards
100+ integrations. OTel native, works with your existing stack.
