Search in OpenSearch Dashboards

OpenSearch Dashboards provide the following search tools:

  • Filters

  • Queries

  • Full-text search

Filters enable you to organize the output information using the interface tools. You can search for information by a set of indexed fields using a variety of logical operators.

Queries enable you to construct search commands using OpenSearch query domain-specific language (DSL) expressions. These expressions allow you to search by the fields not included in the index.

In addition to filters and queries, you can use the Search input field for full-text search.

Create a filter

  1. From the dashboard view, click Add filter.

  2. In the dialog that opens, select the field of search in the Field drop-down menu.

  3. Select the logical operator in the Operator drop-down menu.

  4. Type or select the filter value from the Value drop-down menu.

Create a filter using the ‘flat object’ field type

Available since 2.23.0 (12.7.0 and 11.7.0)

For the orchestrator.labels field of the system and audit log indices, you can use the flat_object field type to apply the filtering using value or valueAndPath. For example:

  • Using value: to obtain all logs produced by iam-proxy, add the following filters:

    • orchestrator.type that matches kubernetes

    • orchestrator.labels._value that matches iam-proxy

  • Using valueAndPath: to obtain all logs produced by the OpenSearch cluster, add the following filters:

    • orchestrator.type that matches kubernetes

    • orchestrator.labels._valueAndPath that matches orchestrator.labels.app=opensearch-master

Create a query

  1. From the dashboard view, click Add filter.

  2. In the dialog that opens, click Edit as Query DSL and type in the search request.

Learn more

OpenSearch documentation: