Dashboards, alerting and observability

1. OpenSearch Dashboards #

Exploring and visualizing.

First steps #

1. Create an index pattern (for example logs-app-*) choosing the time field.
2. In Discover, search and filter your documents.
3. Build visualizations, then assemble them into a dashboard.
4. Open Dev Tools to try your queries.

Menus may vary by version. This part describes the console from the documentation: only the APIs of this course were run.

2. Alerting #

Monitors and triggers.

A monitor through the API #

A monitor runs a query at a regular interval; a trigger evaluates a condition on the result; an action notifies through a channel.

curl -sk -u 'admin:Str0ng!Passw0rd-2026' -H 'Content-Type: application/json' -X POST https://localhost:9200/_plugins/_alerting/monitors -d '{
  "type": "monitor",
  "name": "erreurs_logs",
  "monitor_type": "query_level_monitor",
  "enabled": true,
  "schedule": {"period": {"interval": 1, "unit": "MINUTES"}},
  "inputs": [{"search": {"indices": ["logs-app-*"],
    "query": {"size": 0, "query": {"term": {"level": "error"}}}}}],
  "triggers": [{"name": "au_moins_une_erreur", "severity": "2",
    "condition": {"script": {"source": "ctx.results[0].hits.total.value > 0", "lang": "painless"}},
    "actions": []}]
}'

Add an action once the channel is created in Notifications.

3. Observability #

Logs, traces and anomalies.

What the platform offers #