opensearch_multi_terms
Aggregate multiple keyword fields in OpenSearch with a single request, reducing round trips. Supports time range and query filters.
Instructions
Preferred over calling opensearch_terms in a loop — single round-trip for multiple fields.
Inherits the .keyword guidance from opensearch_terms: append .keyword to any text-like field name to avoid fielddata heap pressure.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Index name or wildcard pattern. | |
| to_ts | No | End time, UTC ISO 8601. | |
| from_ts | No | Start time, UTC ISO 8601. | |
| ts_field | No | Timestamp field name (default "@timestamp"). | @timestamp |
| aggregations | Yes | List of aggregation specs, each a dict with: - id (str): Label for this aggregation in the result. - field (str): Keyword field to aggregate. - size (int, optional): Top N values (default 50). Example: [{"id": "agents", "field": "agent.name", "size": 20}, {"id": "rules", "field": "rule.id", "size": 10}, {"id": "sources", "field": "data.srcip", "size": 30}] | |
| query_string | No | Lucene filter (default "*"). | * |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||