logs

Search and analyze OpenSearch logs using PPL queries.

34|32|Updated Jan 28, 2026

Search Tags:#monitoring #logs #diagnostics #log-analysis #opensearch #trace-correlation #ppl

Ready to run

npx skills add https://github.com/opensearch-project/observability-stack --skill logs-opensearch-project

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: logs
Source: https://github.com/opensearch-project/observability-stack/tree/main/claude-code-observability-plugin/skills/logs
Command: npx skills add https://github.com/opensearch-project/observability-stack --skill logs-opensearch-project

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzing and debugging distributed applications often requires fast access to log data. This skill enables you to search and filter OpenSearch logs using PPL, correlate traces, and identify error patterns across services.

Core Features & Use Cases

PPL templates for querying logs from the logs-otel-v1-* index pattern.
Trace correlation by traceId and spanId to diagnose distributed operations.
Severity filtering and error-pattern detection for quick triage and insight into system behavior.
Use case: investigate a spike in errors by linking log messages to traces and service context.

Quick Start

Run a sample PPL query against the OpenSearch cluster using the PPL API to retrieve recent error logs and linked traces.

Frequently Asked Questions about logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I query OpenSearch logs to investigate a spike in application errors?▼

You can query OpenSearch logs to investigate error spikes by using PPL to filter by severity and identify error patterns. This skill targets the logs-otel-v1-* index pattern to help you quickly triage and uncover system behavior anomalies.

How do I correlate traces to diagnose operations in distributed applications using OpenSearch?▼

Correlate traces in distributed applications by querying OpenSearch logs with PPL to link log messages by traceId and spanId. This connects log entries to traces and service context, diagnosing distributed operations across components.

Can I analyze log volume and service interactions across components stored in OpenSearch?▼

Yes, you can analyze log volume and trace service interactions across components by running PPL queries against the logs-otel-v1-* index pattern. This provides insight into distributed application behavior and monitoring scope.

What environment variables do I need to connect to the OpenSearch PPL API for log analysis?▼

Connecting to the OpenSearch PPL API for log analysis requires setting the OPENSEARCH_ENDPOINT, OPENSEARCH_USER, and OPENSEARCH_PASSWORD environment variables. The skill uses HTTPS and basic authentication at the /_plugins/_ppl endpoint.

What is the best way to filter log severity and uncover error patterns in OpenSearch?▼

The best way to filter log severity and uncover error patterns in OpenSearch is by applying PPL templates through this skill. It enables severity filtering and error-pattern detection for quick triage and insight into system behavior.