openobserve-api

Query, ingest, and manage OpenObserve logs, streams, and dashboards via REST API.

1.1k|107|Updated Jul 9, 2025
One-click install
npx skills add https://github.com/fcakyon/claude-codex-settings --skill openobserve-api
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: openobserve-api
Source: https://github.com/fcakyon/claude-codex-settings/tree/main/plugins/openobserve-skills/skills/openobserve-api
Command: npx skills add https://github.com/fcakyon/claude-codex-settings --skill openobserve-api

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Working with OpenObserve programmatically is error-prone: there is no official CLI, timestamps are in microseconds, dashboard updates require hash-based optimistic concurrency, and hand-written SQL panels silently re-aggregate data. This Skill gives an AI agent the exact curl commands, panel JSON schema, and known pitfalls needed to operate any OpenObserve Cloud or self-hosted instance correctly.

Core Features & Use Cases

  • Search and SQL queries: Run DataFusion SQL against logs, metrics, and traces with correct microsecond time ranges, pagination, histograms, and full-text functions like match_all and str_match.
  • Dashboard automation: Create, read, update, and delete dashboards and individual panels using the v8 panel JSON schema, with hash-aware PUT requests that avoid 409 conflicts.
  • Ingestion and stream management: Ingest data via JSON, NDJSON, Elasticsearch bulk, OTLP, Loki, or Prometheus remote-write, and manage stream schemas, settings, folders, and alerts.
  • Use Case: Ask the agent to build a cost-tracking dashboard: it fetches an existing dashboard as a template, adds a metric panel with a SUM query, sets the currency unit, and PUTs the unwrapped v8 body back with the current hash.

Quick Start

Ask the agent to query the top hosts by message count from your OpenObserve stream over the last 24 hours using your instance URL, organization, and credentials.

Frequently Asked Questions about openobserve-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query OpenObserve logs with the REST API?

Send a POST to /api/{org}/_search with a JSON body containing a SQL query, start_time, and end_time in microseconds. Authenticate with HTTP basic auth using your email and password; there is no token endpoint or official CLI.

How do I create or update an OpenObserve dashboard via API?

POST the unwrapped inner v8 dashboard object to /api/{org}/dashboards?folder=default. For updates, first GET the dashboard to obtain its current hash, then PUT the modified v8 body with ?hash=<hash>; a 409 response means you must refetch and retry.

Why does my OpenObserve dashboard panel show duplicate rows or inflated numbers?

This happens when customQuery is true and fields.y entries keep the default aggregationFunction of sum, causing re-aggregation of already-aggregated SQL results. Set aggregationFunction to null on every x and y field when your SQL contains COUNT, SUM, or AVG.

What timestamp format does the OpenObserve API use?

OpenObserve uses microseconds since Unix epoch (Date.now() times 1000), not milliseconds. Using millisecond values returns no hits without an error, so always multiply seconds by 1,000,000 for start_time and end_time.

How do I ingest logs into OpenObserve from external tools?

OpenObserve accepts JSON arrays at /{stream}/_json, NDJSON at /{stream}/_multi, Elasticsearch bulk at /_bulk, OTLP at /v1/logs, Loki push at /loki/api/v1/push, and Prometheus remote-write. All endpoints use the same basic auth header.

Is there an official OpenObserve CLI or SDK?

There is no first-party CLI. Community SDKs exist for Python and Go, but they lag the server feature set, so plain curl against the REST API is the recommended approach for most automation tasks.