1. OpenSearch Dashboards #
Exploring and visualizing.
First steps #
- Create an index pattern (for example
logs-app-*) choosing the time field. - In Discover, search and filter your documents.
- Build visualizations, then assemble them into a dashboard.
- Open Dev Tools to try your queries.
Menus may vary by version. This part describes the console from the documentation: only the APIs of this course were run.
2. Alerting #
Monitors and triggers.
A monitor through the API #
A monitor runs a query at a regular interval; a trigger evaluates a condition on the result; an action notifies through a channel.
curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X POST https://localhost:9200/_plugins/_alerting/monitors -d '{
"type": "monitor",
"name": "erreurs_logs",
"monitor_type": "query_level_monitor",
"enabled": true,
"schedule": {"period": {"interval": 1, "unit": "MINUTES"}},
"inputs": [{"search": {"indices": ["logs-app-*"],
"query": {"size": 0, "query": {"term": {"level": "error"}}}}}],
"triggers": [{"name": "au_moins_une_erreur", "severity": "2",
"condition": {"script": {"source": "ctx.results[0].hits.total.value > 0", "lang": "painless"}},
"actions": []}]
}'Add an action once the channel is created in Notifications.
3. Observability #
Logs, traces and anomalies.
What the platform offers #
| Feature | Purpose |
|---|---|
| Trace Analytics | Request paths and service map, from the indexes fed by Data Prepper |
| Event Analytics | Explore events with PPL |
| Anomaly Detection | Automatically detect deviations on a metric |
| Security Analytics | Detection rules on security logs |
