Searching for Data in Inspector

1. Start with the right place

OpenSearch Dashboards usually lets you search in Discover or inside a Dashboard.

• Use Discover when you want to inspect raw records or logs.
• Use Dashboards when you want to filter charts, tables, and visual panels.

OpenSearch Dashboards supports search using DQL, short for Dashboards Query Language, and also Lucene/query string syntax. DQL is usually easier for everyday dashboard filtering.

2. Set the time range first

Before searching, check the time picker, usually in the top-right corner.

Examples:

• Last 15 minutes
• Last 24 hours
• Last 7 days
• Custom date range

Many “missing data” problems are caused by the wrong time range.

3. Basic search examples

Search for a word

error

Finds records that contain "error".

Search a specific event rule ID

Add filter, select rule.id from the field drop down. Choose the 'operator' and the rule ID for 'value'

Most dashboards let you click values in charts or tables to add filters.

Example:

1. Click a service name.
2. Choose Filter for value.
3. The dashboard refreshes using that filter.

This is often easier than typing a query manually and it is the recommended query method as you learn to use Inspector

Common useful searches

Troubleshooting

If your search returns no results, check these:

1. Time range — Is it too narrow?
2. Field name — Is the field spelled correctly?
3. Value format — Does the value need quotes?
4. Dashboard filters — Is another filter hiding results?
5. Data source/index pattern — Are you searching the right data?

Best practices

• Set the time range first.
• Start broad, then narrow down.
• Use field searches instead of plain text when possible.
• Use quotes for values with spaces.
• Clear old filters before starting a new search.
• Save useful searches if your dashboard supports saved queries.