opensearch_discover_fields
Sample live documents to discover available fields in an OpenSearch index, useful when the mapping API is blocked. Requires only search privilege.
Instructions
Fallback for opensearch_get_mapping when the mapping API is blocked; samples live documents.
Only returns fields that actually appear in the sampled documents — fields absent from the sample won't be listed. Unlike opensearch_get_mapping, only requires search privilege. Increase sample_size for broader field coverage (max 100).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Index name or wildcard pattern. | |
| to_ts | No | Sample up to this timestamp, UTC ISO 8601. | |
| from_ts | No | Sample from this timestamp, UTC ISO 8601 (e.g. "2026-06-01T00:00:00Z"). | |
| ts_field | No | Timestamp field name (default "@timestamp"). | @timestamp |
| sample_size | No | Number of documents to sample (default 10, max 100). | |
| query_string | No | Lucene filter to narrow the sample (default "*"). | * |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||