elasticsearch-logs

Use an ESQL query with STATS COUNT(*) or a search request with track_total_hits set to true. A bare search caps the reported total at 10,000 and drops the qualifier, so the number can be arbitrarily wrong on large indices.

First run get_mappings on the index to learn real field names, then use a search with a term query, for example severity equals error. Use the .keyword sub-field for exact matches, grouping, and sorting rather than the analysed text field.

Empty results usually come from guessed field names, querying a text field instead of its .keyword variant, or a time range that does not match how data is timestamped. Verify the index holds data with list_indices and confirm fields with get_mappings before concluding no events occurred.

No. All five tools are read-only: list_indices, get_mappings, search, esql, and get_shards. There is no index, update, or delete verb, and a read-only API key with view_index_metadata is sufficient.

Choose based on where the logs actually live: this skill for Elasticsearch/ELK indices, splunk-search for Splunk, and datadog-logs for Datadog. Querying the wrong backend returns empty results that are indistinguishable from an absence of events.