skills.rest
opensearch-project
opensearch-projectOFFICIAL
Explore all skills by this author →
WebsiteGitHub

logs

Search and analyze OpenSearch logs using PPL queries.

34|32|Updated Jan 28, 2026
Search Tags:#monitoring#logs#diagnostics#log-analysis#opensearch#trace-correlation#ppl
One-click install
npx skills add https://github.com/opensearch-project/observability-stack --skill logs-opensearch-project
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: logs
Source: https://github.com/opensearch-project/observability-stack/tree/main/claude-code-observability-plugin/skills/logs
Command: npx skills add https://github.com/opensearch-project/observability-stack --skill logs-opensearch-project

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzing and debugging distributed applications often requires fast access to log data. This skill enables you to search and filter OpenSearch logs using PPL, correlate traces, and identify error patterns across services.

Core Features & Use Cases

  • PPL templates for querying logs from the logs-otel-v1-* index pattern.
  • Trace correlation by traceId and spanId to diagnose distributed operations.
  • Severity filtering and error-pattern detection for quick triage and insight into system behavior.
  • Use case: investigate a spike in errors by linking log messages to traces and service context.

Quick Start

Run a sample PPL query against the OpenSearch cluster using the PPL API to retrieve recent error logs and linked traces.

Frequently Asked Questions about logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query OpenSearch logs to investigate a spike in application errors?▼

You can query OpenSearch logs to investigate error spikes by using PPL to filter by severity and identify error patterns. This skill targets the logs-otel-v1-* index pattern to help you quickly triage and uncover system behavior anomalies.

How do I correlate traces to diagnose operations in distributed applications using OpenSearch?▼

Correlate traces in distributed applications by querying OpenSearch logs with PPL to link log messages by traceId and spanId. This connects log entries to traces and service context, diagnosing distributed operations across components.

Can I analyze log volume and service interactions across components stored in OpenSearch?▼

Yes, you can analyze log volume and trace service interactions across components by running PPL queries against the logs-otel-v1-* index pattern. This provides insight into distributed application behavior and monitoring scope.

What environment variables do I need to connect to the OpenSearch PPL API for log analysis?▼

Connecting to the OpenSearch PPL API for log analysis requires setting the OPENSEARCH_ENDPOINT, OPENSEARCH_USER, and OPENSEARCH_PASSWORD environment variables. The skill uses HTTPS and basic authentication at the /_plugins/_ppl endpoint.

What is the best way to filter log severity and uncover error patterns in OpenSearch?▼

The best way to filter log severity and uncover error patterns in OpenSearch is by applying PPL templates through this skill. It enables severity filtering and error-pattern detection for quick triage and insight into system behavior.

Related Skills

Explore More Data & Analytics Skills→
opensearch-projectopensearch-project
34

traces

Query OpenSearch trace data with PPL to analyze agent invocations and errors.

Official
Intermediate
krzemienskikrzemienski
2

observability-report

Analyze Shannon log files for session traces, health checks, and audits.

Community
Advanced
opensearch-projectopensearch-project
40

observability

Analyze and correlate log and trace data in OpenSearch clusters.

Official
Intermediate
rfdiosuaorfdiosuao
30

elasticsearch

Guide Elasticsearch cluster operations, index mappings, queries, and aggregations.

Community
Advanced