log-analytics

Discover indices, mappings, and data formats in OpenSearch clusters.

40|41|Updated Apr 1, 2026

Search Tags:#monitoring #logs #anomaly-detection #log-analysis #data-discovery #OpenSearch #PPL

Ready to run

npx skills add https://github.com/opensearch-project/opensearch-agent-skills --skill log-analytics

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: log-analytics
Source: https://github.com/opensearch-project/opensearch-agent-skills/tree/main/skills/opensearch-skills/observability/log-analytics
Command: npx skills add https://github.com/opensearch-project/opensearch-agent-skills --skill log-analytics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Discover and interpret log data stored in OpenSearch without assuming index names or schemas, enabling faster troubleshooting and observability.

Core Features & Use Cases

Discover indices, mappings, and data formats for log data across local and cloud OpenSearch deployments.
Build and run PPL queries to measure log volume, detect errors, extract top messages, and identify anomalies.
Correlate log data with traces and other sources to investigate incidents and improve system reliability.

Quick Start

Analyze a representative log dataset by running a guided PPL query to surface volume trends, error counts, and top messages for your targeted index pattern.

Frequently Asked Questions about log-analytics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze OpenSearch logs without knowing the index names or schemas?▼

You can discover and interpret log data stored in OpenSearch without assuming index names or schemas by applying a discovery-first workflow. This approach identifies indices, mappings, and data formats dynamically, enabling faster troubleshooting and observability.

How do I use PPL queries to detect log anomalies in OpenSearch?▼

You can build and run PPL queries to measure log volume, detect errors, extract top messages, and identify anomalies in OpenSearch. The system prioritizes PPL for querying and provides fallbacks for complex analytics when needed.

Can I analyze log data stored in AWS-hosted OpenSearch deployments like AOS and AOSS?▼

Yes, you can identify and analyze log data stored in AWS-hosted OpenSearch deployments, including AOS and AOSS. The system supports local and cloud OpenSearch deployments to ensure broad compatibility for log analysis tasks.

What is the best way to correlate OpenSearch logs with traces to investigate incidents?▼

The best way to correlate OpenSearch logs with traces is to use discovery workflows that identify log indices and then run targeted PPL queries. This correlation helps investigate incidents and improve system reliability by linking related data sources.

Does log analysis with OpenSearch provide fallbacks for complex analytics?▼

Yes, log analysis with OpenSearch provides fallbacks for complex analytics. While it prioritizes PPL for querying log data, it ensures advanced analytical requirements are met through alternative processing methods within the workflow.

When do I need a discovery-first workflow for OpenSearch log analysis?▼

You need a discovery-first workflow for OpenSearch log analysis when you must determine indices, mappings, and data formats across unfamiliar local or AWS-hosted deployments. This process is essential to interpret log data without assuming existing schemas.