Log Analytics in OpenSearch with PPL: Filter, Aggregate, and Correlate
· 5 min read
OpenSearch SQL is familiar, but Piped Processing Language (PPL) is often better for log analysis: its pipeline syntax maps naturally to how you think about filtering and aggregating event streams. Each | stage narrows or transforms the result set from the previous one. This post runs five PPL queries against a 200-document structured log dataset on a live OpenSearch 2.19.1 cluster managed by FoundryDB. Every number below is from a real query.
All commands use YOUR_OPENSEARCH_HOST and YOUR_PASSWORD as placeholders.
OpenSearch cluster, query fan-out & gather
Cluster green · search fans out to one copy per shard, then gathers
Coordinatorfan-out / gatherquery →Data nodesP0 P1 P2 · R0 R1 R2⇠ hitsCluster-managershard allocation