Skip to content

[FEATURE] Add OpenSearch datasource and log query plugin with PPL support#641

Open
Oliver-ke wants to merge 13 commits intoperses:mainfrom
Oliver-ke:feature/opensearch-plugin
Open

[FEATURE] Add OpenSearch datasource and log query plugin with PPL support#641
Oliver-ke wants to merge 13 commits intoperses:mainfrom
Oliver-ke:feature/opensearch-plugin

Conversation

@Oliver-ke
Copy link
Copy Markdown

@Oliver-ke Oliver-ke commented Apr 27, 2026

Description

Adds an OpenSearch datasource + log query plugin

These changes includes:

  • Plugin scaffold — OpenSearchDatasource + OpenSearchLogQuery plugins (TypeScript, React, Module Federation via rsbuild).
  • PPL client (opensearch-client.ts) - POSTs to /_plugins/_ppl, handles relative datasource URLs, throws a typed OpenSearchPPLError(status, body) on non-200.
  • Time bounding + row mapping (get-opensearch-log-data.ts) - wraps user PPL with a where clause on the configured timestamp field; maps rows to LogEntry and surfaces
    remaining columns (e.g. traceId) as labels.
  • Field-name overrides - timestampField / messageField on the query spec for indexes that don't use @timestamp / message (e.g. OpenTelemetry's body).
  • Editor (OpenSearchLogQueryEditor.tsx) - datasource picker, index pattern, timestamp/message field overrides, PPL textarea, and an inline Alert driven by an optional
    queryError prop (parses error.reason / error.details from the OpenSearch error JSON).
  • Trace-to-logs pivot - relies on the existing replaceVariables path, so a $traceId dashboard variable substitutes into the PPL before send. Example dashboard at
    opensearch/docs/examples/trace-to-logs.json (Tempo + OpenSearch; Jaeger swap documented).
  • CUE schema (schemas/queries/opensearch-log-query/query.cue) - mirrors the TS spec including the new optional fields.
  • Go SDK (sdk/go/query/log) - PluginSpec + TimestampField() / MessageField() options for dashboards-as-code.
  • Tests - 26 TS tests (PPL bounder, row mapper with overrides + fallbacks, $traceId substitution + dependsOn, PPL client URL/headers/error, editor inputs + error alert)
    and 2 Go tests (builder JSON shape + omitempty for optional fields).

Screenshots

image

DataSource
image

Checklist

  • Pull request has a descriptive title and context useful to a reviewer.
  • Pull request title follows the [<catalog_entry>] <commit message> naming convention using one of the
    following catalog_entry values: FEATURE, ENHANCEMENT, BUGFIX, BREAKINGCHANGE, DOC,IGNORE.
  • All commits have DCO signoffs.

UI Changes

  • Changes that impact the UI include screenshots and/or screencasts of the relevant changes.
  • Code follows the UI guidelines.

Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Oliver-ke added 6 commits May 10, 2026 05:34
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
The bound was being appended at the end of the user query, which fails
once the user pipeline drops @timestamp from the schema (stats, fields,
top). Tests now describe the intended ordering. Implementation follows.

Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
…cker file

Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
@Oliver-ke Oliver-ke force-pushed the feature/opensearch-plugin branch from 0963d7f to 496c296 Compare May 10, 2026 04:35
Oliver-ke added 6 commits May 10, 2026 08:18
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
Signed-off-by: Azorji Kelechi Oliver <kelechioliver96@gmail.com>
…search-plugin

chore(plugins): update with remote main branch
@Oliver-ke Oliver-ke marked this pull request as ready for review May 10, 2026 17:13
@Oliver-ke Oliver-ke requested review from a team, AntoineThebaud and Nexucis as code owners May 10, 2026 17:13
@Oliver-ke Oliver-ke requested review from jgbernalp and removed request for a team May 10, 2026 17:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant