Question: Indexer vs OpenSearch Operator

[akobir-arc]

Looking for some feedback here - I noticed that the chart has the ability to point to an existing/external indexer - technically this could be pointed to an OpenSearch cluster managed by the operator.

What are the tradeoffs here?

[morgoved]

You can try this )

[akartach]

I'm using wazuh in a case with OpenSearch operator.
There are a few problems here:

1. The standard image opensearch-dashboards or wazuh-dashboard won't work.
2. You'll need to pull the wazuh plugins yourself.
3. You'll need to dynamically modify the wazuh.yml configuration, which cannot be done through the opensearch-operator CRD. My solution is to build a custom image from opensearch-dashboards with a modified ENTRYPOINT that generates the wazuh.yml.