opensearch_terms
Show the top values in a keyword field with their document counts to identify common log data patterns.
Instructions
Frequency table for a keyword field — top N values with their document counts.
If results look wrong or you see a heap warning, append .keyword to the field name (e.g. agent.name.keyword). Never use on analyzed text fields like rule.description — aggregations on text fields load fielddata into cluster heap.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Number of top values to return (default 50). | |
| field | Yes | Keyword field to aggregate, e.g. "agent.name", "rule.id", "data.srcip". | |
| index | Yes | Index name or wildcard pattern. | |
| to_ts | No | End time, UTC ISO 8601. | |
| from_ts | No | Start time, UTC ISO 8601. | |
| ts_field | No | Timestamp field name (default "@timestamp"). | @timestamp |
| query_string | No | Lucene filter (default "*"). | * |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||