opensearch_histogram
Count events over time in an OpenSearch index, with customizable time range and bucket intervals.
Instructions
Event count over time; always specify from_ts and to_ts (meaningless without a range).
Use interval="auto" when unsure — it picks ~50 buckets and is always safe. Fine intervals over long ranges (e.g. "1m" over a week) are rejected before the query runs to protect cluster resources.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Index name or wildcard pattern. | |
| to_ts | Yes | End time, UTC ISO 8601 (required), e.g. "2026-06-24T00:00:00Z". | |
| from_ts | Yes | Start time, UTC ISO 8601 (required), e.g. "2026-06-23T00:00:00Z". | |
| interval | No | Bucket size — e.g. "1h", "30m", "1d", "15m", or "auto". | 1h |
| ts_field | No | Timestamp field name (default "@timestamp"). | @timestamp |
| query_string | No | Lucene filter (default "*"). | * |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||