discover_search
Search log data using OpenSearch Dashboards' internal Discover API. Filter by index pattern, Lucene query, time range, and fields to retrieve matching documents.
Instructions
Fetch documents like the Discover app.
Runs a search against an index pattern through the internal search API
that OpenSearch Dashboards' Discover uses (/internal/search/opensearch),
so it works even when the raw OpenSearch REST API is not exposed.
index: index-pattern glob, e.g.logs-api-*(discover them vialist_saved_objectswithtype_="index-pattern").query: Lucene query_string, e.g.level:error AND service:api.Nonematches everything.time_from/time_to: range ontime_field, e.g.now-15m/nowor an ISO timestamp. Both optional.time_field: timestamp field to filter/sort on (default@timestamp).size: max hits to return (default 10; keep small — these are logs).fields: restrict_sourceto these fields to avoid flooding the context.Nonereturns the full document.tenant:securitytenantheader; usually unnecessary for raw data.
Returns {index, total, count, hits: [{_id, _index, _source}]} where
total is the full match count (may be an estimate for large indices).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | ||
| index | Yes | ||
| query | No | ||
| fields | No | ||
| tenant | No | ||
| time_to | No | ||
| time_from | No | ||
| time_field | No | @timestamp |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||