Observability Guides
EspañolEnglish
← Back to guidesGuide

Investigate log spikes with OpenSearch PPL without hot shards misleading you

A practical incident workflow for OpenSearch 3.8 PPL that validates shards, queues, and ingest freshness before drawing conclusions.

Combine PPL, Dev Tools, and cluster metrics to investigate error spikes without confusing an application issue with shard skew or search pressure.

Created: August 10, 2026

Published: August 10, 2026

Estimated time40 min
LevelAdvanced
Before you startOpenSearch Dashboards with PPL available, ideally 3.8 or later.
PlatformsLinux / Docker
WhatsAppXLinkedIn

Linux

Run PPL queries from Dashboards and validate shard bias with curl or Dev Tools before changing dashboards or alerts.

curloptional jqread credentials for OpenSearch
Cluster health
curl -s "$OPENSEARCH_URL/_cluster/health?pretty"
Log index shards
curl -s "$OPENSEARCH_URL/_cat/shards/logs-prod-*?v&h=index,shard,prirep,state,docs,store,node"
Search pressure by node
curl -s "$OPENSEARCH_URL/_nodes/stats/indices/search,thread_pool?pretty"
Also available inInvestigar picos de logs con PPL en OpenSearch sin que los hot shards te engañen

Content locked

This guide requires both steps before full content is available.

  • ○Click “Like” on this guide.
  • ○Share on WhatsApp, X, LinkedIn, or copy the link.

Access is automatically unlocked as soon as both steps are completed.