本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# 使用 Amazon 监控 OpenSearch 服务事件 EventBridge
Amazon S OpenSearch ervice EventBridge 与亚马逊集成，可通知您某些影响您域名的事件。来自 AWS 服务的事件几乎实时 EventBridge 地传送到。同样的事件也会发送到[亚马逊 CloudWatch ](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatchEvents.html)的前身 Amazon Events EventBridge。您可以编写简单规则来指示您关注的事件，并指示要在事件匹配规则时执行的自动化操作。可自动触发的操作包括：
+ 调用函数 AWS Lambda
+ 调用 Amazon EC2 Run Command
+ 将事件中继到 Amazon Kinesis Data Streams
+ 激活 AWS Step Functions 状态机
+ 通知 Amazon SNS 主题或 Amazon SQS 队列
有关更多信息，请参阅《[亚马逊* EventBridge 用户指南》 EventBridge中的 “亚马逊*入门](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-get-started.html)”。
**Topics**
+ [服务软件更新事件](#monitoring-events-sso)
+ [自动调整事件](#monitoring-events-autotune)
+ [集群运行状况事件](#monitoring-events-cluster-health)
+ [VPC 端点事件](#monitoring-events-vpc)
+ [节点停用事件](#monitoring-events-nr)
+ [性能降级节点停用事件](#monitoring-events-degraded-nr)
+ [域错误事件](#monitoring-events-errors)
+ [教程：监听亚马逊 OpenSearch 服务 EventBridge 事件](listening-events.md)
+ [教程：发送有关可用软件更新的 Amazon SNS 警报](sns-events.md)
## 服务软件更新事件
OpenSearch 当发生以下服务[软件更新事件之一 EventBridge 时，服务](service-software.md)会将事件发送到。
### 可用服务软件更新
OpenSearch 当服务软件更新可用时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Available",
"severity": "Informational",
"description": "Service software update R20220928 available. Service Software Deployment Mechanism:
Blue/Green. For more information on deployment configuration, please
see: https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-configuration-changes.html"
}
}
```
### 已安排服务软件更新
OpenSearch 服务会在安排服务软件更新时发送此事件。对于*可选的*更新，您会在计划日期收到通知，并且可以随时选择重新安排。对于*必需的*更新，您会在计划日期前的三天收到通知，并且可以在强制窗口中选择重新安排。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Scheduled",
"severity": "High",
"description": "A new service software update [R20200330-p1] has been scheduled at [21st May 2023 12:40 GMT].
Please see documentation for more information on scheduling software updates:
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html."
}
}
```
### 已重新安排服务软件更新
OpenSearch 重新安排可选服务软件更新时，服务会发送此事件。有关更多信息，请参阅 [可选更新与必需更新](service-software.md#service-software-optional-required)。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Rescheduled",
"severity": "High",
"description": "The service software update [R20200330-p1], which was originally scheduled for
[21st May 2023 12:40 GMT], has been rescheduled to [23rd May 2023 12:40 GMT].
Please see documentation for more information on scheduling software updates:
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html."
}
}
```
### 服务软件更新已启动
OpenSearch 服务软件更新开始后，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Started",
"severity": "Informational",
"description": "Service software update [R20200330-p1] started.
}
}
```
### 服务软件更新已完成
OpenSearch 服务软件更新完成后，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Completed",
"severity": "Informational",
"description": "Service software update [R20200330-p1] completed."
}
}
```
### 已取消服务软件更新
OpenSearch 服务软件更新取消后，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Cancelled",
"severity": "Informational",
"description": "The scheduled service software update [R20200330-p1] has been cancelled as a
newer update is available. Please schedule the latest update."
}
}
```
### 已取消计划服务软件更新
OpenSearch 当先前为该域安排的服务软件更新被取消时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Cancelled",
"severity": "Informational",
"description": "The scheduled service software update [R20200330-p1] has been cancelled."
}
}
```
### 未执行服务软件更新
OpenSearch 服务在无法启动服务软件更新时会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Unexecuted",
"severity": "Informational",
"description": "The scheduled service software update [R20200330-p1] cannot be started. Reason: [reason]"
}
}
```
### 服务软件更新失败
OpenSearch 当服务软件更新失败时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Failed",
"severity": "High",
"description": "Installation of service software update [R20200330-p1] failed. [reason].
}
}
```
### 已要求服务软件更新
OpenSearch 当需要更新服务软件时，服务会发送此事件。有关更多信息，请参阅 [可选更新与必需更新](service-software.md#service-software-optional-required)。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Software Update Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2016-11-01T13:12:22Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Service Software Update",
"status": "Required",
"severity": "High",
"description": "Service software update [R20200330-p1] available. Update
will be automatically installed after [21st May 2023] if no
action is taken. Service Software Deployment Mechanism: Blue/Green.
For more information on deployment configuration, please see:
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-configuration-changes.html"
}
}
```
## 自动调整事件
OpenSearch 当以下任一[自动调整](auto-tune.md)事件发生 EventBridge 时，服务会将事件发送到。
### 自动调整挂起
OpenSearch 当 Auto-Tune 确定了改善集群性能和可用性的调整建议时，服务会发送此事件。您只能看到已禁用自动调整的域的此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Auto-Tune Event",
"severity": "Informational",
"status": "Pending",
"description": "Auto-Tune recommends the following new settings for your domain: { JVM Heap size : 60%}. Enable Auto-Tune to improve cluster stability and performance.",
"scheduleTime": "{iso8601-timestamp}"
}
}
```
### 自动调整已开始
OpenSearch 当 Auto-Tune 开始对您的域应用新设置时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Auto-Tune Event",
"severity": "Informational",
"status": "Started",
"scheduleTime": "{iso8601-timestamp}",
"startTime": "{iso8601-timestamp}",
"description" : "Auto-Tune is applying the following settings to your domain: { JVM Heap size : 60%}."
}
}
```
### 自动调整需要按计划部署 blue/green
OpenSearch 当 Auto-Tune 确定了需要计划 blue/green 部署的调整建议时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Auto-Tune Event",
"severity": "Low",
"status": "Pending",
"startTime": "{iso8601-timestamp}",
"description": "Auto-Tune has identified the following settings for your domain that require a blue/green deployment: { JVM Heap size : 60%}.
You can schedule the deployment for your preferred time."
}
}
```
### 自动调整已取消
OpenSearch 由于没有待处理的调整建议而取消了 Auto-Tune 计划时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Auto-Tune Event",
"severity": "Low",
"status": "Cancelled",
"scheduleTime": "{iso8601-timestamp}",
"description": "Auto-Tune has cancelled the upcoming blue/green deployment."
}
}
```
### 自动调整已完成
OpenSearch 当 Auto-Tune 已完成 blue/green 部署并且集群在设置了新 JVM 设置的情况下可以运行时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Auto-Tune Event",
"severity": "Informational",
"status": "Completed",
"completionTime": "{iso8601-timestamp}",
"description": "Auto-Tune has completed the blue/green deployment and successfully applied the following settings: { JVM Heap size : 60%}."
}
}
```
### 已禁用自动调整并恢复更改
OpenSearch 当 Auto-Tune 被禁用并且应用的更改已回滚时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": [ "arn:aws:es:us-east-1:123456789012:domain/test-domain" ],
"detail": {
"event": "Auto-Tune Event",
"severity": "Informational",
"status": "Completed",
"description": "Auto-Tune is now disabled. All settings have been reverted. Auto-Tune will continue to evaluate
cluster performance and provide recommendations.",
"completionTime": "{iso8601-timestamp}"
}
}
```
### 已禁用自动调整并保留更改
OpenSearch 当禁用 Auto-Tune 并且保留了应用的更改时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "3acb26c8-397c-4c89-a80a-ce672a864c55",
"detail-type": "Amazon OpenSearch Service Auto-Tune Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2020-10-30T22:06:31Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Auto-Tune Event",
"severity": "Informational",
"status": "Completed",
"description": "Auto-Tune is now disabled. The most-recent settings by Auto-Tune have been retained.
Auto-Tune will continue to evaluate cluster performance and provide recommendations.",
"completionTime": "{iso8601-timestamp}"
}
}
```
## 集群运行状况事件
OpenSearch EventBridge 当您的集群的运行状况受到威胁时，服务会向发送某些事件。
### 红色集群恢复已开始
OpenSearch 在您的集群状态持续变为红色超过一个小时后，服务会发送此事件。它会尝试从快照中自动还原一个或多个红色索引，以修复集群状态。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Cluster Status Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"Automatic Snapshot Restore for Red Indices",
"status":"Started",
"severity":"High",
"description":"Your cluster status is red. We have started automatic snapshot restore for the red indices.
No action is needed from your side. Red indices [red-index-0, red-index-1]"
}
}
```
### 红色集群恢复部分完成
OpenSearch 当服务在尝试修复红色群集状态时只能从快照中恢复部分红色索引时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Cluster Status Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"Automatic Snapshot Restore for Red Indices",
"status":"Partially Restored",
"severity":"High",
"description":"Your cluster status is red. We were able to restore the following Red indices from
snapshot: [red-index-0]. Indices not restored: [red-index-1]. Please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps."
}
}
```
### 红色集群恢复失败
OpenSearch 如果服务在尝试修复红色群集状态时未能恢复任何索引，则会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Cluster Status Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"Automatic Snapshot Restore for Red Indices",
"status":"Failed",
"severity":"High",
"description":"Your cluster status is red. We were unable to restore the Red indices automatically.
Indices not restored: [red-index-0, red-index-1]. Please refer https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps."
}
}
```
### 要删除的分片
OpenSearch 如果服务在您的红色群集状态持续变为红色 14 天后尝试自动修复该状态，但一个或多个索引仍为红色，则服务会发送此事件。再过 7 天（总共 21 天持续变红）后，S OpenSearch ervic [e 继续删除所有红色索引上未分配的分片](#monitoring-events-red-deleted)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Cluster Status Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2022-04-09T10:36:48Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"severity":"Medium",
"description":"Your cluster status is red. Please fix the red indices as soon as possible.
If not fixed by 2022-04-12 01:51:47+00:00, we will delete all unassigned shards,
the unit of storage and compute, for these red indices to recover your domain and make it green.
Please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps.
test_data, test_data1",
"event":"Automatic Snapshot Restore for Red Indices",
"status":"Shard(s) to be deleted"
}
}
```
### 分片已删除
OpenSearch 在您的集群状态持续变为红色 21 天后，服务会发送此事件。它会删除所有红色索引上未分配的分片（存储和计算）。有关更多信息，请参阅 [自动修复红色集群](handling-errors.md#handling-errors-red-cluster-status-auto-recovery)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Cluster Status Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2022-04-09T10:54:48Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"severity":"High",
"description":"We have deleted unassinged shards, the unit of storage and compute, in
red indices: index-1, index-2 because these indices were red for more than
21 days and could not be restored with the automated restore process.
Please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-red-cluster-status for troubleshooting steps.",
"event":"Automatic Snapshot Restore for Red Indices",
"status":"Shard(s) deleted"
}
}
```
### 高分片数警告
OpenSearch 当您的热数据节点的平均分片数超过建议的默认限制（1,000）的 90% 时，服务会发送此事件。尽管更高版本的 Elasticsearch OpenSearch 支持可配置的每个节点的最大分片数限制，但我们建议每个节点的分片数不超过 1,000 个。请参阅[选择分片数](bp-sharding.md)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"High Shard Count",
"status":"Warning",
"severity":"Low",
"description":"One or more data nodes have close to 1000 shards. To ensure optimum performance and stability of your
cluster, please refer to the best practice guidelines - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/sizing-domains.html#bp-sharding."
}
}
```
### 超出分片数限制
OpenSearch 当您的热数据节点的平均分片数超过建议的默认限制 1,000 时，服务会发送此事件。尽管更高版本的 Elasticsearch OpenSearch 支持可配置的每个节点的最大分片数限制，但我们建议每个节点的分片数不超过 1,000 个。请参阅[选择分片数](bp-sharding.md)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"High Shard Count",
"status":"Warning",
"severity":"Medium",
"description":"One or more data nodes have more than 1000 shards. To ensure optimum performance and stability of your
cluster, please refer to the best practice guidelines - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/sizing-domains.html#bp-sharding."
}
}
```
### 磁盘空间不足
OpenSearch 当集群中的一个或多个节点的可用存储空间少于 25% 或小于 25 GB 时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Low Disk Space",
"status":"Warning",
"severity":"Medium",
"description":"One or more data nodes in your cluster has less than 25% of storage space or less than 25GB.
Your cluster will be blocked for writes at 20% or 20GB. Please refer to the documentation for more information - https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#troubleshooting-cluster-block"
}
}
```
### 低磁盘水位违例
OpenSearch 当集群中所有节点的可用存储空间低于 10% 或小于 10 GB 时，服务会发送此事件。当所有节点都发生低磁盘水位违例时，任何新的索引都会生成一个黄色的集群，而当所有节点都低于高磁盘水位时，它将产生一个红色集群。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Low Disk Watermark Breach",
"status":"Warning",
"severity":"Medium",
"description":"Low Disk Watermark threshold is about to be breached. Once the threshold is breached, new index creation will be blocked on all
nodes to prevent the cluster status from turning red. Please increase disk size to suit your storage needs. For more information,
see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#troubleshooting-cluster-block".
}
}
```
### EBS 可爆发容量余额低于 70%
OpenSearch 当一个或多个数据节点上的 EBS 突发平衡降至 70% 以下时，服务会发送此事件。EBS 突发平衡耗尽会导致集群普遍不可用和请求受限，从而导致索引和搜索 I/O 请求出现高延迟和超时。有关修复此问题的步骤，请参阅[EBS 可爆发容量余额低](handling-errors.md#handling-errors-low-ebs-burst)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"EBS Burst Balance",
"status":"Warning",
"severity":"Medium",
"description":"EBS burst balance on one or more data nodes is below 70%.
Follow https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-low-ebs-burst
to fix this issue."
}
}
```
### EBS 可爆发容量余额低于 20%
OpenSearch 当一个或多个数据节点上的 EBS 突发平衡降至 20% 以下时，服务会发送此事件。EBS 突发平衡耗尽会导致集群普遍不可用和请求受限，从而导致索引和搜索 I/O 请求出现高延迟和超时。有关修复此问题的步骤，请参阅[EBS 可爆发容量余额低](handling-errors.md#handling-errors-low-ebs-burst)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"EBS Burst Balance",
"status":"Warning",
"severity":"High",
"description":"EBS burst balance on one or more data nodes is below 20%.
Follow https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html#handling-errors-low-ebs-burst
to fix this issue.
}
}
```
### 磁盘吞吐量节流
OpenSearch 由于您的 EBS 卷或 EC2 实例的吞吐量限制，对您的域的读取和写入请求受到限制时，服务会发送此事件。如果您收到此通知，请考虑按照 AWS 推荐的最佳实践扩展您的卷或实例。如果您的卷类型是 `gp2`，请增加卷大小。如果您的卷类型是 `gp3`，请预调配更多吞吐量。您还可以检查您的实例基础和最大 EBS 吞吐量是否大于或等于预调配的卷吞吐量，并可以相应扩展。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Disk Throughput Throttle",
"status":"Warning",
"severity":"Medium",
"description":"Your domain is experiencing throttling due to instance or volume throughput limitations.
Please consider scaling your domain to suit your throughput needs. In July 2023, we improved
the accuracy of throughput throttle calculation by replacing ‘Max volume throughput’ with
‘Provisioned volume throughput’. Please refer to the documentation for more information."
}
}
```
### 分片大小较大
OpenSearch 当集群中的一个或多个分片超过 50GiB 或 65GiB 时，服务会发送此事件。为确保最佳集群性能和稳定性，请减少分片大小。
有关更多信息，请参阅[分片最佳实践](bp.md#bp-sharding-strategy)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Large Shard Size",
"status":"Warning",
"severity":"Medium",
"description":"One or more shards are larger than 65GiB. To ensure optimum cluster performance and stability, reduce shard sizes.
For more information, see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html#monitoring-events-large-shard-size."
}
}
```
### 高 JVM 使用率
OpenSearch 当您的域名的`JVMMemoryPressure`指标超过 80% 时，服务会发送此事件。如果在 30 分钟内超过 92%，则对集群的所有写入操作都将被阻止。为确保最佳的集群稳定性，请减少集群流量或扩展域，以便为工作负载提供足够的内存。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"High JVM Usage",
"status":"Warning",
"severity":"High",
"description":"JVM memory pressure has exceeded 80%. If it exceeds 92% for 30 minutes, all write operations to your cluster
will be blocked. To ensure optimum cluster stability, reduce traffic to the cluster or use larger instance types.
For more information, see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html#monitoring-events-high-jvm."
}
}
```
### GC 不足
OpenSearch 当最大 JVM 大于 70% 且最大值和最小值之差小于 30% 时，服务会发送此事件。这可能表明 JVM 无法在垃圾回收周期中回收足够的内存来处理您的工作负载。这可能会导致响应速度越来越慢和延迟增加；在某些情况下，甚至会因为运行状况检查超时而导致节点掉线。为确保最佳的集群稳定性，请减少集群流量或扩展域，以便为工作负载提供足够的内存。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Insufficient GC",
"status":"Warning",
"severity":"Medium",
"description":"Maximum JVM is above 70% and JVM range is less than 30%. This may indicate insufficient garbage collection for your workload.
For more information, see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html#monitoring-events-insufficient-gc."
}
}
```
### 自定义索引路由警告
OpenSearch 当您的域处于处理状态并且包含带有自定义 index.routing.allocation 设置的索引时，服务会发送此事件，这可能会导致蓝绿色部署卡住。验证设置是否正确应用。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Custom Index Routing Warning",
"status":"Warning",
"severity":"Medium",
"description":"Your domain is in processing state and contains indice(s) with custom index.routing.allocation
settings which can cause blue-green deployments to get stuck. Verify settings are applied properly.
For more information, see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html#monitoring-events-index-routing."
}
}
```
### 分片锁定失败
OpenSearch 当您的域名由于未分配分片而导致运行状况不佳时，服务会发送此事件。`[ShardLockObtainFailedException]`有关更多信息，请参阅[如何解决 Ama OpenSearch zon Service 中的内存分片锁定异常](https://aws.amazon.com/premiumsupport/knowledge-center/opensearch-in-memory-shard-lock/)？
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2017-12-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Failed Shard Lock",
"status":"Warning",
"severity":"Medium",
"description":"Your domain is unhealthy due to unassigned shards with [ShardLockObtainFailedException]. For more information,
see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html#monitoring-events-failed-shard-lock."
}
```
## VPC 端点事件
OpenSearch 服务将某些事件发送到 EventBridge 与[AWS PrivateLink 接口端点](vpc-interface-endpoints.md)相关的事件。
### VPC 端点创建失败
OpenSearch 服务在无法创建请求的 VPC 终端节点时发送此事件。发生此错误可能是因为您已达到针对某一区域内允许的 VPC 端点数量的限制。如果指定子网或安全组不存在，您也会看到此错误。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service VPC Endpoint Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"VPC Endpoint Create Validation",
"status":"Failed",
"severity":"High",
"description":"Unable to create VPC endpoint aos-0d4c74c0342343 for domain
arn:aws:es:eu-south-1:123456789012:domain/my-domain due to the following validation failures: You've reached the limit on the
number of VPC endpoints that you can create in the AWS Region."
}
}
```
### VPC 端点更新失败
OpenSearch 服务在无法删除请求的 VPC 终端节点时发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service VPC Endpoint Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"VPC Endpoint Update Validation",
"status":"Failed",
"severity":"High",
"description":"Unable to update VPC endpoint aos-0d4c74c0342343 for domain
arn:aws:es:eu-south-1:123456789012:domain/my-domain due to the following validation failures: ."
}
}
```
### VPC 端点删除失败
OpenSearch 服务在无法删除请求的 VPC 终端节点时发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service VPC Endpoint Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"VPC Endpoint Delete Validation",
"status":"Failed",
"severity":"High",
"description":"Unable to delete VPC endpoint aos-0d4c74c0342343 for domain
arn:aws:es:eu-south-1:123456789012:domain/my-domain due to the following validation failures: Specified subnet doesn't exist."
}
}
```
## 节点停用事件
OpenSearch 当发生以下节点停用事件之一 EventBridge 时，服务会向发送事件。
### 已计划停用节点
OpenSearch 在安排节点停用时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2023-04-07T10:07:33Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Node Retirement Notification",
"status": "Scheduled",
"severity": "Medium",
"description": "An automated action to retire and replace a node has been scheduled on your domain.
The node will be replaced in the next off-peak window. For more information, see
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html."
}
}
```
### 已完成节点停用
OpenSearch 节点停用完成后，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2023-04-07T10:07:33Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Node Retirement Notification",
"status": "Completed",
"severity": "Medium",
"description": "The node has been retired and replaced with a new node."
}
}
```
### 节点停用失败
OpenSearch 当节点停用失败时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Amazon OpenSearch Service Notification",
"source": "aws.es",
"account": "123456789012",
"time": "2023-04-07T10:07:33Z",
"region": "us-east-1",
"resources": ["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail": {
"event": "Node Retirement Notification",
"status": "Failed",
"severity": "Medium",
"description": "Node retirement failed. No actions are required from your end. We will automatically
retry replacing the node."
}
}
```
## 性能降级节点停用事件
OpenSearch 当由于节点上的硬件降级而需要更换节点时，服务会发送这些事件。
### 性能降级节点停用通知
OpenSearch 当已为你的域安排了停用和替换降级节点的自动操作时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"db233454-aad1-7676-3b15-10a84b052baa",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2024-01-11T08:16:06Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-node-replacement"
],
"detail":{
"severity":"Medium",
"description":"An automated action to retire and replace a node has been scheduled on your domain. For more information, please see https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-events.html.",
"event":"Degraded Node Retirement Notification",
"status":"Scheduled"
}
}
```
### 性能降级节点停用完成
OpenSearch 当降级的节点已停用并替换为新节点时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"7444215c-90f9-a52d-bcda-e85973a9a762",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2024-01-11T10:20:30Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-node-replacement"
],
"detail":{
"severity":"Medium",
"description":"The node has been retired and replaced with a new node.",
"event":"Degraded Node Retirement Notification",
"status":"Completed"
}
}
```
### 性能降级节点停用失败
OpenSearch 如果降级节点停用失败，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"c328e9bb-93b9-c0b2-b17a-df527fdf96b6",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2024-01-11T08:31:38Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-node-replacement"
],
"detail":{
"severity":"Medium",
"description":"Node retirement failed. No actions are required from your end. We will automatically re-try replacing the node.",
"event":"Degraded Node Retirement Notification",
"status":"Failed"
}
}
```
## 域错误事件
OpenSearch 当出现以下域错误之一 EventBridge 时，服务会向发送事件。
### 域更新验证故障
OpenSearch 如果服务在尝试更新域或对域执行配置更改时遇到一个或多个验证失败，则会发送此事件。要获取解决这些故障的步骤，请参阅[对验证错误进行故障排除](managedomains-configuration-changes.md#validation)。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Domain Update Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":[
"arn:aws:es:us-east-1:123456789012:domain/test-domain"
],
"detail":{
"event":"Domain Update Validation",
"status":"Failed",
"severity":"High",
"description":"Unable to perform updates to your domain due to the following validation failures:
Please see the documentation for more information https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-configuration-changes.html#validation"
}
}
```
### KMS 密钥不可访问
OpenSearch 服务在[无法访问您的 AWS KMS 密钥](encryption-at-rest.md#disabled-key)时发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Domain Error Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2016-11-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"KMS Key Inaccessible",
"status":"Error",
"severity":"High",
"description":"The KMS key associated with this domain is inaccessible. You are at risk of losing access to your domain.
For more information, please refer to https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html#disabled-key."
}
}
```
### 域隔离
OpenSearch 当您的域名变得隔离并且由于网络无法访问而无法接收、读取或写入请求时，服务会发送此事件。
**示例**
以下是该类型的示例事件：
```
{
"version":"0",
"id":"01234567-0123-0123-0123-012345678901",
"detail-type":"Amazon OpenSearch Service Notification",
"source":"aws.es",
"account":"123456789012",
"time":"2023-11-01T13:12:22Z",
"region":"us-east-1",
"resources":["arn:aws:es:us-east-1:123456789012:domain/test-domain"],
"detail":{
"event":"Domain Isolation Notification",
"status":"Error",
"severity":"High",
"description":"Your OpenSearch Service domain has been isolated. An isolated domain is unreachable by network and cannot receive, read, or write requests. For more information and assistance, please contact AWS Support at https://docs.aws.amazon.com/opensearch-service/latest/developerguide/encryption-at-rest.html#disabled-key."
}
}
```
# 教程：监听亚马逊 OpenSearch 服务 EventBridge 事件
在本教程中，您设置了一个用于监听 Amazon S OpenSearch ervice 事件并将其写入 CloudWatch 日志流的简单 AWS Lambda 函数。
## 先决条件
本教程假设您已有 OpenSearch 服务域。如果您尚未创建域，请按照 [创建和管理亚马逊 OpenSearch 服务域名](createupdatedomains.md) 中的步骤创建一个。
## 第 1 步：创建 Lambda 函数
在此过程中，您将创建一个简单的 Lambda 函数作为 OpenSearch 服务事件消息的目标。
**创建目标 Lambda 函数**
1. 打开 AWS Lambda 控制台，网址为[https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/)。
1. 依次选择 **Create function ** 和 **Author from scratch**。
1. 对于**函数名称**，请输入 **event-handler**。
1. 对于**运行时系统**，选择 **Python 3.8**。
1. 选择**创建函数**。
1. 在 **Function code** 部分中，编辑示例代码以匹配以下示例：
```
import json
def lambda_handler(event, context):
if event["source"] != "aws.es":
raise ValueError("Function only supports input from events with a source type of: aws.es")
print(json.dumps(event))
```
这是一个简单的 Python 3.8 函数，用于打印 OpenSearch 服务发送的事件。如果所有配置都正确，则在本教程结束时，事件详细信息将显示在与此 Lambda 函数关联的 CloudWatch 日志流中。
1. 选择**部署**。
## 步骤 2：注册事件规则
在此步骤中，您将创建一条 EventBridge 规则，用于捕获来自您的 OpenSearch 服务域的事件。该规则捕获来自定义该规则的账户中的所有事件。事件消息本身包含有关事件源的信息（包括事件源所在的域）。您可以使用此信息以编程方式过滤和排序事件。
**创建 EventBridge 规则**
1. 打开 EventBridge 控制台，网址为[https://console.aws.amazon.com/events/](https://console.aws.amazon.com/events/)。
1. 选择 **Create rule**（创建规则）。
1. 将规则命名为 **event-rule**。
1. 选择**下一步**。
1. 对于事件模式，请选择**AWS 服务**、**Amazon OpenSearch 服务和****所有事件**。这种模式适用于您的所有 OpenSearch 服务域和每个 OpenSearch 服务事件。或者，您也可以创建一个更具体的模式来过滤掉一些结果。
1. 按 **Next**（下一步）。
1. 对于目标，选择 **Lambda function**（Lambda 函数）。在函数下拉菜单中，选择 **event-handler**。
1. 按 **Next**（下一步）。
1. 跳过标签，然后再次按 **Next**（下一步）。
1. 检查配置并选择 **Create rule**（创建规则）。
## 第 3 步：测试您的配置
下次您在 OpenSearch 服务控制台的 “**通知**” 部分收到通知时，如果一切配置正确，则会触发您的 Lambda 函数，并将事件数据写入该函数的 CloudWatch 日志流中。
**测试配置**
1. 打开 CloudWatch 控制台，网址为[https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/)。
1. 在导航窗格上，选择**日志**，然后为您的 Lambda 函数选择日志组（例如，**/aws/lambda/event-** handler）。
1. 选择日志流以查看事件数据。
# 教程：发送有关可用软件更新的 Amazon SNS 警报
在本教程中，您将配置亚马逊 EventBridge 事件规则，该规则用于捕获亚马逊服务中可用服务软件更新的通知，并通过 Amazon Simple Notification Service (A OpenSearch mazon SNS) 向您发送电子邮件通知。
## 先决条件
本教程假设您已有 OpenSearch 服务域。如果您尚未创建域，请按照 [创建和管理亚马逊 OpenSearch 服务域名](createupdatedomains.md) 中的步骤创建一个。
## 步骤 1：创建并订阅 Amazon SNS 主题
在本教程中，您配置一个 Amazon SNS 主题来充当新事件规则的事件目标。
**创建 Amazon SNS 目标**
1. [在 v3/home 上打开亚马逊 SNS 控制台。https://console.aws.amazon.com/sns/](https://console.aws.amazon.com/sns/v3/home)
1. 选择**主题**和**创建主题**。
1. 对于作业类型，请选择**标准**，并命名作业为 **software-update**。
1. 选择 **创建主题**。
1. 创建主题后，选择**创建订阅**。
1. 对于**协议**，选择**电子邮件**。对于**端点**，输入您当前有权访问的电子邮件地址，然后选择 **创建订阅**。
1. 检查您的电子邮件账户，并等待接收订阅确认电子邮件。在收到此电子邮件后，选择 **确认订阅**。
## 步骤 2：注册事件规则
接下来，注册一个仅捕获服务软件更新事件的事件规则。
**创建事件规则**
1. 打开 EventBridge 控制台，网址为[https://console.aws.amazon.com/events/](https://console.aws.amazon.com/events/)。
1. 选择 **Create rule**（创建规则）。
1. 将规则命名为 **softwareupdate-rule**。
1. 选择**下一步**。
1. 对于事件模式，选择**AWS 服务**、**亚马逊 OpenSearch 服务（托管集群）**和**亚马逊 OpenSearch 服务软件更新通知**。此模式与来自 OpenSearch 服务的任何服务软件更新事件相匹配。有关事件模式的更多信息，请参阅[亚马逊* EventBridge用户指南中的亚马逊 EventBridge *事件模式](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-patterns.html)。
1. 您还可以进行筛选以仅针对特定的严重性。有关每个事件的严重性，请参阅[服务软件更新事件](monitoring-events.md#monitoring-events-sso)。
1. 选择**下一步**。
1. 对于目标，请选择 **SNS topic**（SNS 主题），然后选择 **software-update**。
1. 选择**下一步**。
1. 跳过标签，然后选择 **Next**（下一步）。
1. 检查规则配置并选择 **Create rule**（创建规则）。
下次您收到服务部门关于可用 OpenSearch 服务软件更新的通知时，如果一切配置正确，Amazon SNS 应向您发送有关该更新的电子邮件提醒。