search
Execute OpenSearch query DSL requests on Wazuh 5 datastreams to fetch security events and findings, receiving raw JSON responses with diagnostics when results are incomplete or need interpretation.
Instructions
Run an OpenSearch query DSL request against a Wazuh 5 index pattern.
Returns the raw JSON response, including aggregations, preceded by a
diagnostics block when the result needs interpretation (zero hits, a
truncated total, or an aggregation that covers only part of the result set).
Common patterns:
wazuh-events-v5-* all events
wazuh-findings-v5-* all detection findings
wazuh-events-v5-* one of: access-management, applications, cloud-services, network-activity, other, security, system-activity, unclassified
These are datastreams. Always query the wildcard pattern, never a backing index such as .ds-wazuh-events-v5-network-activity-000001.
The time field is @timestamp. There is no timestamp field in Wazuh 5.
Set "track_total_hits": true whenever you need an exact count; without it
OpenSearch stops counting at 10000.
A "size" larger than KLAXON_SEARCH_MAX_SIZE (default 100) is lowered to that limit before the query is sent, and the diagnostics block says so. Use "size": 0 with aggregations to count without pulling documents.
The same cap applies to the size of bucketed aggregations (terms,
significant_terms, significant_text, multi_terms, composite, top_hits):
an oversized aggregation size is lowered to KLAXON_SEARCH_MAX_SIZE before
the query is sent and an "[AGG SIZE CAPPED]" diagnostics line names the
affected aggregation and its requested size, so a lowered bucket count is
never read as the real one.
When anonymization is enabled and KLAXON_ANONYMIZATION_MASK_AGGREGATION_KEYS
is on, aggregation bucket keys for masked fields (terms, multi_terms,
composite) are replaced with the same deterministic tokens as the _source
pass — so aggregation keys and hits stay aligned for the same entity.
Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". body: OpenSearch query DSL as a JSON string.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| index | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |