Check OpenSearch Dashboards connectivity and authenticate.

Hits the security authinfo endpoint. If unauthenticated (HTTP 401) and credentials are configured, performs a session login and re-checks. Reports {connected, authenticated, user, tenants} or the error reason.

List saved objects of a given type (dashboard, index-pattern, search, ...).

Calls the Dashboards saved_objects/_find API and returns a compact list of {id, title, type} so the LLM is not flooded with raw fields.

Saved objects are stored per multi-tenancy tenant. tenant selects which one to read via the securitytenant header:

• a tenant name (e.g. "Developers Core", "Global")

• "user" for the caller's private tenant

• None (default) uses the user's configured default tenant Use the get_tenants tool to discover available tenant names.

List multi-tenancy tenants configured in OpenSearch Dashboards.

Uses the security plugin config API (/api/v1/configuration/tenants), which returns a map of tenant name -> metadata. Flattened here to a list of {name, description, reserved, hidden}.

List index patterns configured in OpenSearch Dashboards.

Index patterns are saved objects of type index-pattern. Returns {id, title, time_field} where title is the pattern glob (e.g. logs-*) and time_field its time field, if any.

Fetch documents like the Discover app.

Runs a search against an index pattern through the internal search API that OpenSearch Dashboards' Discover uses (/internal/search/opensearch), so it works even when the raw OpenSearch REST API is not exposed.

• index: index-pattern glob, e.g. logs-api-* (discover them via list_saved_objects with type_="index-pattern").

• query: Lucene query_string, e.g. level:error AND service:api. None matches everything.

• time_from / time_to: range on time_field, e.g. now-15m / now or an ISO timestamp. Both optional.

• time_field: timestamp field to filter/sort on (default @timestamp).

• size: max hits to return (default 10; keep small — these are logs).

• fields: restrict _source to these fields to avoid flooding the context. None returns the full document.

• tenant: securitytenant header; usually unnecessary for raw data.

Returns {index, total, count, hits: [{_id, _index, _source}]} where total is the full match count (may be an estimate for large indices).