search
Run read-only OpenSearch Query DSL queries against specified indexes to retrieve matching documents. Specify index and query body, optionally limit result size for log analysis and troubleshooting.
Instructions
Execute a read-only search query against an index using OpenSearch Query DSL.
The query_body must be a valid JSON string representing the query portion. Example: {"query": {"match": {"message": "error"}}, "sort": [{"@timestamp": "desc"}]}
Args: index: Index name or pattern to search (e.g. 'filebeat-*'). query_body: JSON string with the OpenSearch Query DSL body. size: Maximum number of results to return (default 20, max 100).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | ||
| index | Yes | ||
| query_body | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |