#4242·arkime

Add support for other ES/OS template formats

Author: EllinorDexCreated Sep 6, 2026Updated Sep 6, 2026
Labelsenhancement

Describe the bug The script does not support the new OpenSearch API (some endpoints and request parameters differ).

A case in point is index template creation during db.pl init: in the version of OpenSearch being used, the request is sent to /_index_template rather than /_template. Additionally, the cluster_manager_timeout and master_timeout request parameters differ. This is just one of many instances of incompatibility.

This behavior was discovered due to an attempt to create a custom ILM policy using an index template. But no index template was found in opensearch.

Elasticsearch version: OpenSearch 3.6.0

Arkime/Moloch version: 5.6.0

OS name and version: Ubuntu 24.04 LTS

How was Arkime/Moloch built/installed: service in docker swarm

Provide logs, stack traces and steps to reproduce: