search
Query Wazuh 5 datastreams with OpenSearch query DSL, returning raw JSON responses, aggregations, and diagnostics for empty or incomplete results.
Instructions
Run an OpenSearch query DSL request against a Wazuh 5 index pattern.
Returns the raw JSON response, including aggregations, preceded by a
diagnostics block when the result needs interpretation (zero hits, a
truncated total, or an aggregation that covers only part of the result set).
Common patterns:
wazuh-events-v5-* all events
wazuh-findings-v5-* all detection findings
wazuh-events-v5-* one of: access-management, applications, cloud-services, network-activity, other, security, system-activity, unclassified
These are datastreams. Always query the wildcard pattern, never a backing index such as .ds-wazuh-events-v5-network-activity-000001.
The time field is @timestamp. There is no timestamp field in Wazuh 5.
Set "track_total_hits": true whenever you need an exact count; without it
OpenSearch stops counting at 10000.
A "size" larger than WAZUH_SEARCH_MAX_SIZE (default 100) is lowered to that limit before the query is sent, and the diagnostics block says so. Use "size": 0 with aggregations to count without pulling documents.
Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". body: OpenSearch query DSL as a JSON string.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| index | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |