opensearch_explain
Explains why a document matches or fails to match a query in OpenSearch, helping diagnose unexpected search results by providing reasoning for a specific document's relevance.
Instructions
Explain why a specific document matches (or doesn't match) a query.
Use after opensearch_search returns unexpected results and you have a known document ID. Get the doc ID from a prior search by including "_id" in source_fields (note: _id is a metadata field — use opensearch_search and read the _id from hits). Exact index name only — no wildcards.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Exact index name, e.g. "wazuh-alerts-4.x-2026.06.24". | |
| doc_id | Yes | Document _id as returned by a prior search. | |
| query_string | No | Lucene query to evaluate against the document (default "*"). | * |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||