What problem does it solve? Investigating production incidents in Elasticsearch or OpenSearch often leads to dumping raw logs, which is slow and overwhelming. This Skill enforces a statistics-first workflow so you understand log volume, error rates, and top error patterns before sampling any individual log entries. ## Core Features & Use Cases - Statistics-First Investigation: The get_statistics.py script reports total log count, error rate, level distribution, top services, and normalized top error patterns with an actionable recommendation. - Strategic Log Sampling: The sample_logs.py script supports errors_only, warnings_up, around_time, and all strategies to fetch only relevant logs within bounded time ranges. - Query Reference: Built-in guidance for Lucene query syntax and Query DSL, including bool queries, aggregations, and keyword vs text field handling. - Use Case: During an incident, run get_statistics.py against logs-production to see a 12% error rate concentrated in one service, then sample errors around the spike timestamp to identify the root cause pattern. ## Quick Start Ask the agent to investigate errors in the logs-production Elasticsearch index over the last hour, starting with overall statistics and then sampling the top error patterns.
