available_log_fields
Discover which log fields exist in your data by sampling matching documents, so you know which paths are valid to aggregate, display, or filter before investigating.
Instructions
Returns every populated field path (dotted) found in a sample of matching log docs, annotated with each field's type and aggregatability from the dashboard's field-caps API when available. Call this ONCE at the start of a fresh investigation to learn the schema: what aggregate_fields and display_fields paths are valid in this data. The tool samples hits stratified across kubernetes.container_name values (FIELDS_STRATIFY_FIELD env) so rare container types still contribute their fields, walks each doc's _source, and returns a deduplicated list grouped to keep kubernetes.annotations.* collapsed.
Use the result to decide which fields to summarize, exclude, include, or display. Subsequent investigation turns rarely need to re-call this because the schema is stable across queries.
Tip: pair it on the very first turn with a summarize_logs call (in parallel) so you get distributions and schema in one shot.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| level | No | Filter on the level field (LEVEL_FIELD env, default logs.level; currently `logs.level`), e.g. 'ERROR' or ['ERROR','WARN']. Prefer this over putting ERROR in query, which also matches INFO messages containing the word error. | |
| query | Yes | Same as search_logs: picks docs to sample. An empty string or '*' matches all documents. The text is matched against these fields: message, logs.message, msg, log, logs.loggerName, logs.thread, logs.thrown.name, logs.thrown.message, logs.request, logs.requestFirstLine (override with the QUERY_FIELDS env var). | |
| time_to | No | Absolute end time, ISO 8601. Without time_from, the window starts minutes_lookback before this. | |
| query_dsl | No | Raw OpenSearch/Elasticsearch query DSL clause, AND-ed into the bool filter alongside `query` and the time range. Use for anything the plain text query can't express: numeric ranges ({range: {status: {gte: 500}}}), wildcards ({wildcard: {'url.keyword': '/api/*'}}), OR logic ({bool: {should: [...], minimum_should_match: 1}}), exists checks, etc. | |
| time_from | No | Absolute start time, ISO 8601 (e.g. '2026-09-23T10:28:00Z'). Without time_to, the window runs from here to now. | |
| environment | No | Which dashboard environment to search, as configured in the extension popup. The extension has not reported any environments yet, so omit this unless the user names one. | |
| search_type | No | ||
| exclude_filters | No | ||
| include_filters | No | ||
| minutes_lookback | No | Window length in minutes. Default 60. With neither time_from nor time_to it means the last N minutes up to now; with only time_to it means the N minutes ending at time_to; ignored when time_from is given. The response header always shows the resolved absolute UTC window. |