[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for OpenSearch](../../index.md) > [Step-by-step guides](../index.md) > [Connection](index.md) > Connecting from applications

# Connecting to an OpenSearch cluster from applications

This section provides settings for connecting to Managed Service for OpenSearch cluster hosts using [command line tools](#command-line-tools), [OpenSearch Dashboards](#dashboards), and from a [Docker container](#connection-docker). To learn how to connect from your application code, see [Code examples](code-examples.md).

## Command line tools {#command-line-tools}

To see code examples with the host FQDN filled in, open the cluster page in the [management console](https://console.yandex.cloud) and click **Connect**.

### Linux (Bash) {#bash}

{% list tabs group=connection %}

- Connecting with SSL {#with-ssl}

    ```bash
    curl \
        --user admin:<password> \
        --cacert ~/.opensearch/root.crt \
        --request GET 'https://<FQDN_of_OpenSearch_host_with_public_access>:9200/'
    ```

{% endlist %}

Learn how to get a host FQDN in [this guide](fqdn.md).

### Windows (PowerShell) {#powershell}

{% list tabs group=connection %}

- Connecting with SSL {#with-ssl}

   ```powershell
   curl `
     -Certificate <absolute_path_to_certificate_file> `
     -Uri https://<FQDN_of_OpenSearch_host_with_DATA_role>:9200 `
     -Credential admin
   ```

{% endlist %}

Learn how to get a host FQDN in [this guide](fqdn.md).

## Connecting to OpenSearch Dashboards {#dashboards}


You can connect to OpenSearch Dashboards:

* Over the internet, if public access is enabled for a host with the `DASHBOARDS` role.
* From a VM in Yandex Cloud, if public access is not enabled for any of your hosts with the `DASHBOARDS` role.

{% list tabs group=connection_method %}

- Over the internet {#internet}

    1. Install the [SSL certificate](index.md#ssl-certificate) in your browser's store of trusted root certificates (see the instructions for Mozilla Firefox [here](https://wiki.mozilla.org/PSM:Changing_Trust_Settings#Trusting_an_Additional_Root_Certificate)).
    1. On the cluster page in the management console, click **OpenSearch Dashboards** or go to `https://c-<cluster_ID>.rw.mdb.yandexcloud.net` in your browser.

        You can get the cluster ID with the [list of clusters in the folder](../cluster-list.md#list-clusters).

    1. Enter `admin` for the username and the password you set when [creating the cluster](../cluster-create.md).

- From a Yandex Cloud VM {#cloud}

    1. [Create](../../../compute/quickstart/quick-create-linux.md) a Linux VM in the same [virtual network](../../../vpc/concepts/network.md) as the cluster.
    1. [Connect](../../../compute/operations/vm-connect/ssh.md) to the VM over SSH.
    1. Install the dependencies:
    
       ```bash
       sudo apt update && \
       sudo apt install --yes nginx ssl-cert
       ```

    1. Copy the downloaded SSL certificate to the `/etc/nginx/` directory:

       ```bash
       sudo cp ~/.opensearch/root.crt /etc/nginx/root.crt
       ```

    1. Edit the NGINX default configuration file, for example, like this:

       `/etc/nginx/sites-available/default`

       ```nginx
       upstream os-dashboards-nodes {
          server <FQDN_of_host_1_with_DASHBOARDS_role>:443;
          ...
          server <FQDN_of_host_N_with_DASHBOARDS_role>:443;
       }

       server {
          listen 443 ssl;

          ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
          ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

          server_name _;

          location / {

              proxy_pass https://os-dashboards-nodes;

              proxy_ssl_trusted_certificate /etc/nginx/root.crt;
              proxy_ssl_session_reuse on;
          }
       }
       ```

       {% note warning %}

       This configuration file example uses a self-signed `snakeoil` certificate from the `ssl-cert` package. It is not safe to use this certificate in a real cluster. Instead, specify the path to your public and private SSL certificate keys in the `ssl_certificate` and `ssl_certificate_key` directives.

       {% endnote %}

    1. Restart NGINX:

       ```bash
       sudo systemctl restart nginx
       ```

    1. Add the certificate specified in the `ssl_certificate` directive to the browser's trusted root certificate store (see the instructions for Mozilla Firefox [here](https://wiki.mozilla.org/PSM:Changing_Trust_Settings#Trusting_an_Additional_Root_Certificate)).

    1. In your browser, go to `https://<VM_public_IP_address>`.

    1. Enter the username and password for the `admin` user.

{% endlist %}


{% note info %}

When using the OpenSearch Dashboards API:

* To send requests, use `443` instead of the standard port `5601`.
* To use the API, add the SSL certificate path to your application's configuration.

{% endnote %}

## Before you connect from a Docker container {#connection-docker}

To connect to a Managed Service for OpenSearch cluster from a Docker container, add the following lines to the Dockerfile:

{% list tabs group=connection %}


- Connecting without SSL {#without-ssl}

    ```bash
    RUN apt-get update && \
        apt-get install curl --yes
    ```


- Connecting with SSL {#with-ssl}

    ```bash
    RUN apt-get update && \
        apt-get install wget curl --yes && \
        mkdir --parents ~/.opensearch && \
        wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
             --output-document ~/.opensearch/root.crt && \
        chmod 0600 ~/.opensearch/root.crt
    ```

{% endlist %}