opensearch_stats
Compute min, max, average, and standard deviation for a numeric field in an OpenSearch index. Filters by time range and query string are supported.
Instructions
Min/max/avg/std for a numeric field. Only works on numeric types (integer, float, long).
Passing a text field returns a 400 error with a clear message. Use opensearch_terms if you want frequency counts for a keyword field instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | Numeric field, e.g. "rule.level", "data.bytes". | |
| index | Yes | Index name or wildcard pattern. | |
| to_ts | No | End time, UTC ISO 8601. | |
| from_ts | No | Start time, UTC ISO 8601. | |
| ts_field | No | Timestamp field name (default "@timestamp"). | @timestamp |
| query_string | No | Lucene filter (default "*"). | * |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||