Observability Guides
EspañolEnglish
← Back to guidesGuide

Investigate log spikes with OpenSearch PPL without hot shards misleading you

A practical incident workflow for OpenSearch 3.8 PPL that validates shards, queues, and ingest freshness before drawing conclusions.

Combine PPL, Dev Tools, and cluster metrics to investigate error spikes without confusing an application issue with shard skew or search pressure.

Created: August 10, 2026

Published: August 10, 2026

Estimated time40 min
LevelAdvanced
Before you startOpenSearch Dashboards with PPL available, ideally 3.8 or later.
PlatformsLinux / Docker
WhatsAppXLinkedIn

Docker

Useful for labs: rehearse the workflow against a local OpenSearch cluster before applying it to a shared production cluster.

docker composeOpenSearch Dashboardssynthetic log data
Start the lab
docker compose up -d opensearch opensearch-dashboards
Check Dev Tools access
curl -s "http://localhost:9200/_cluster/health?pretty"
Also available inInvestigar picos de logs con PPL en OpenSearch sin que los hot shards te engañen

Content locked

This guide requires both steps before full content is available.

  • ○Click “Like” on this guide.
  • ○Share on WhatsApp, X, LinkedIn, or copy the link.

Access is automatically unlocked as soon as both steps are completed.