opensearch_search
Search OpenSearch indices using Lucene query syntax to retrieve full documents. Supports time range filtering, sorting, pagination, and field selection.
Instructions
Full-document retrieval using Lucene syntax (same as the Dashboards search bar).
Always pass source_fields to limit response size — 50 full docs ≈ 237 KB and will fill context quickly. Omitting from_ts/to_ts scans the full index history, which is slow and expensive; adding a time range reduces query time by up to 15×.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Index name or wildcard pattern, e.g. "wazuh-alerts-*". | |
| limit | No | Max documents to return (default 50, hard cap 200). | |
| to_ts | No | End time, UTC ISO 8601, e.g. "2026-06-24T00:00:00Z". | |
| offset | No | Pagination offset — skip this many documents before returning results (default 0). Increment by limit to page: offset=0 → page 1, offset=50 → page 2, etc. | |
| from_ts | No | Start time, UTC ISO 8601, e.g. "2026-06-23T00:00:00Z". | |
| sort_dir | No | "desc" = newest first (default), "asc" = oldest first. | desc |
| ts_field | No | Timestamp field name (default "@timestamp"). | @timestamp |
| sort_field | No | Field to sort by (default: ts_field). | |
| query_string | No | Lucene query, e.g. "rule.level:[12 TO *] AND agent.name:WIN-DC01". Use "*" for all documents. | * |
| source_fields | No | Fields to include, e.g. ["agent.name", "rule.level", "@timestamp"]. Strongly recommended — omitting returns all fields. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||