AWSCostAWS cost · OpenSearch
An idle OpenSearch domain costs $407/month
An OpenSearch domain is provisioned capacity, not a managed service that scales with use. You pick node types and node counts as you would for EC2, and the domain bills for those nodes every hour whether a query reaches it or not. A cluster built to try centralized logging and then forgotten is one of the most expensive things in an AWS account.
Three r5.large.search nodes cost $407.34/month in us-east-1 - $0.186 per node-hour - and that is instance hours only. Storage bills on top. No console view anywhere labels a domain as idle.
What a domain costs
| What | Cost | Note |
|---|---|---|
| One r5.large.search node | ~$135.78/month | $0.186/hour, us-east-1 |
| A three-node domain | ~$407.34/month | the ordinary shape, before storage |
| Three dedicated master nodes | billed on top | masters are nodes and bill like nodes |
| EBS and UltraWarm storage | billed on top | so the instance figure is a floor |
If you go looking for these rates yourself, note that the price list drops the .search suffix - an r5.large.search node appears as ESInstance:r5.large, under the service code AmazonES that predates the rename from Elasticsearch.
You are paying for three groups of nodes, not one
A domain bills for data nodes, for dedicated masters when they are enabled, and for warm nodes when UltraWarm is on. Masters are the group people forget: AWS recommends three of them, they never serve a query, and they bill like any other node.
That is why a data-node-only estimate is not a rounding error. On an ordinary cluster it understates the real charge by a third or more.
How to find a domain nobody searches
List the domains, read the node counts out of each one, then check whether anything queried or wrote to it in the last two weeks:
# every domain in the region
aws opensearch list-domain-names --query 'DomainNames[].DomainName' --output text
# the nodes each domain bills for - data, masters and warm
aws opensearch describe-domains --domain-names my-logs-domain \
--query 'DomainStatusList[].{Name:DomainName,Data:ClusterConfig.InstanceType,Count:ClusterConfig.InstanceCount,Master:ClusterConfig.DedicatedMasterType,Masters:ClusterConfig.DedicatedMasterCount,Warm:ClusterConfig.WarmType,Warms:ClusterConfig.WarmCount}' \
--output table
# searches over 14 days - both dimensions are required or you get nothing back
aws cloudwatch get-metric-statistics \
--namespace AWS/ES --metric-name SearchRate \
--dimensions Name=ClientId,Value=123456789012 Name=DomainName,Value=my-logs-domain \
--start-time 2026-07-29T00:00:00Z \
--end-time 2026-08-12T00:00:00Z \
--period 86400 --statistics MaximumThat last command has a trap. OpenSearch publishes cluster metrics per domain and per account, so both ClientId - your account id - and DomainName have to be present. Send one without the other and CloudWatch returns an empty set, which looks exactly like a domain nobody uses. Check IndexingRate too: a domain that takes writes but serves no reads is a log sink, not an abandoned cluster.
What the fix costs
Deleting a domain destroys every index in it, and there is no undo. Take a manual snapshot to S3 first. The data then sits at S3 prices instead of node prices, and restoring it into a fresh domain is a documented path rather than a rebuild from source.
A domain kept as a warm standby for failover also reads as zero searches and zero writes, and that is a legitimate reason to keep one. If it exists to hold logs nobody searches, weigh it against CloudWatch Logs or S3 with Athena before rebuilding it at the same size.
# MUTATING - destroys every index in the domain, no undo
aws opensearch delete-domain --domain-name my-logs-domainWant to know whether you are paying $400 a month for a domain nobody queries? Connect your account read-only and see what it is wasting, in real dollars.
The role can only read - Get, Describe, List, nothing else. Read the exact permissions before you deploy it, and delete the stack whenever you want.
Frequently asked questions
How much does an AWS OpenSearch domain cost?+
It is priced per node per hour. An r5.large.search is $0.186/hour in us-east-1, about $135.78/month, so an ordinary three-node domain is roughly $407.34/month before storage. Nothing about that charge depends on whether anyone searches it.
Do I pay for OpenSearch when nobody queries it?+
Yes, in full. The nodes are provisioned capacity, like EC2 instances - they bill for existing, not for answering queries. A domain left over from a logging experiment costs the same as your production search cluster of the same size.
Why is my OpenSearch bill higher than the node count suggests?+
Because a domain bills for up to three groups of nodes, not one. Data nodes are the obvious group; dedicated masters are usually three more, and UltraWarm adds warm nodes. Pricing only the data nodes understates an ordinary cluster by a third or more. Storage bills separately again.
How do I tell whether an OpenSearch domain is being used?+
Read the peaks of SearchRate and IndexingRate over two weeks. Zero on both means nothing queried it and nothing wrote to it. Both metrics need the ClientId and DomainName dimensions together - sending only one matches no data at all, which reads back as an idle domain when it is really a bad query.
Is it safe to delete an unused OpenSearch domain?+
Deleting a domain destroys its indices and there is no undo. Take a manual snapshot to S3 first - it keeps the data at storage prices instead of node prices, and restoring it into a new domain later is a supported path rather than a rebuild from source.
Is there something cheaper than deleting it?+
If the data still matters but the queries do not, a smaller instance type or moving cold indices to UltraWarm both cut the bill without losing anything. If the domain exists to hold logs nobody searches, compare it against CloudWatch Logs or S3 with Athena before rebuilding it at the same size.
Related cost breakdowns
Why Athena is expensive: $5 per TB scanned
Athena charges $5 per terabyte scanned, so an unpartitioned CSV table can cost 10 to 100 times more than the same data as partitioned Parquet. Here is where the scan cost comes from and how to cut it.
Why RDS looks expensive - and how to right-size the instance
A low-traffic MySQL database runs fine on db.t4g.small (~$23/month), not the $100+ tier an AI often quotes. Size RDS to your working set, not your row count.
Your dev and staging RDS databases are billing 24/7
A dev database used 8 hours a day still bills for 24. Scheduling stop/start on non-production RDS saves 50 to 80%. Here is how to stop paying for databases nobody is using at night.
Multi-AZ is doubling your RDS bill - do you need it?
Multi-AZ runs a standby replica around the clock, so it roughly doubles the instance cost. Essential for production, wasteful for dev and staging. Here is how to tell, and how to fix it.