opensearch_ppl
Execute PPL queries on OpenSearch to perform multi-step filtering, aggregation, and sorting in a single pipeline command.
Instructions
Execute a PPL (Piped Processing Language) query against OpenSearch.
Prefer over opensearch_search when you need multi-step pipeline operations (filter → stats → sort) in a single query. Not interchangeable with Lucene — different syntax. Returns 404 if the PPL plugin is not installed.
PPL syntax: source= | [| ...] Common commands: where — filter rows stats count() by — aggregate fields , — select columns sort - — order results (- = descending) head — limit rows
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Full PPL query string. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||