Querying data in OpenSearch Dashboards - Amazon OpenSearch Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Querying data in OpenSearch Dashboards

This is prerelease documentation for Amazon OpenSearch Service direct queries with Amazon S3, which is in preview release. The documentation and the feature are both subject to change. We recommend that you use this feature only in test environments, and not in production environments. For preview terms and conditions, see Betas and Previews in Amazon Service Terms.

After you set up your tables and configure your desired optional query acceleration, you can now start performing analytics on your data. To query your data, select the data source from the dropdown menu on the Discover page or Observability page in OpenSearch Dashboards.

If you're using a skipping index or haven't created an index, you can use SQL or Piped Processing Language (PPL) to query your data. If you've configured a materialized view or a covering index, you already have an index and can use Dashboards Query Language (DQL) throughout Dashboards. You can also use PPL with the Observability plugin, and SQL with the Query Workbench plugin. Currently, only the Observability and Query Workbench plugins support PPL and SQL.

SQL

Use the following query to run a sample SQL query for the http_logs table that you created in Define Amazon Glue Data Catalog tables:

SELECT FIRST(day) AS day, status, COUNT(status) AS status_count_by_day FROM datasourcename.gluedatabasename.gluetablename WHERE status >= 400 GROUP BY day, status ORDER BY day, status LIMIT 20;

PPL

Use the following query to run a sample PPL query for the http_logs table that you created in Define Amazon Glue Data Catalog tables:

source = datasourcename.gluedatabasename.gluetablename | where status = 500 | sort - clientip, @timestamp | head 20