Skip to content

Add log analytics and observability skill references#67

Merged
owaiskazi19 merged 4 commits intoopensearch-project:mainfrom
arjunkumargiri:feat/log-analytics-skill
Mar 25, 2026
Merged

Add log analytics and observability skill references#67
owaiskazi19 merged 4 commits intoopensearch-project:mainfrom
arjunkumargiri:feat/log-analytics-skill

Conversation

@arjunkumargiri
Copy link
Copy Markdown
Contributor

@arjunkumargiri arjunkumargiri commented Mar 23, 2026

Summary

Adds log analytics and observability capabilities to the opensearch-launchpad skill

What's included

Updated SKILL.md:

  • Extended description with log analytics and observability trigger keywords (778 chars, within 1024 spec limit)
  • Added observability routing table pointing to 3 focused reference files
  • Added connection defaults, index patterns, and base PPL command for observability
  • Fixed MCP auto-install messaging to ask user to restart IDE

New reference files under references/observability/:

File Lines Description
log-analytics.md ~360 Discovery-first log analytics workflow: discover indices, understand schema, ask clarifying questions, perform analytics with PPL. Supports any log schema (ECS, OTel, syslog, custom JSON). Instructs agent to use opensearch-mcp-server-py for AOS/AOSS with full auto-install flow.
traces.md ~207 OTel trace investigation: agent invocations, tool executions, slow spans, error spans, token usage, service maps, trace tree reconstruction.
ppl-reference.md ~230 PPL language reference: 50+ commands, 14 function categories, observability examples. Instructs agent to search OpenSearch docs when syntax is unclear.

Design decisions

  • Merged into launchpad skill (not a separate skill) so users get observability capabilities without a separate install
  • Discovery-first approach for log analytics: agent discovers indices, inspects mappings, samples documents, and asks clarifying questions before writing queries
  • opensearch-mcp-server-py as preferred connection method for AOS/AOSS (handles SigV4 transparently), with curl as fallback for local clusters
  • Deferred metrics/SLO/correlation: focused on logs and traces for the initial release
  • Follows Agent Skills spec: SKILL.md under 500 lines, description under 1024 chars, reference files loaded on demand

Testing

  • All 215 agent skills tests pass
  • SKILL.md: 214 lines (spec recommends under 500)
  • Description: 778 chars (spec max 1024)

…ch-launchpad

Update npx skills install commands and directory structure references
in README.md and DESIGN.md to use the correct repository name
opensearch-project/opensearch-launchpad.

Signed-off-by: Arjun kumar Giri <arjung@amazon.com>
Signed-off-by: Arjun kumar Giri <arjung@amazon.com>
Add observability and log analytics capabilities to the opensearch-launchpad
skill. Includes a discovery-first log analytics workflow, OTel trace
investigation guide, and PPL language reference.

Changes:
- Update SKILL.md description with log analytics trigger keywords
- Add observability routing table to SKILL.md
- Add references/observability/log-analytics.md with phased workflow:
  discover indices, understand schema, ask clarifying questions, perform
  analytics with PPL
- Add references/observability/traces.md for OTel trace investigation
- Add references/observability/ppl-reference.md with 50+ commands and
  14 function categories
- Instruct agent to use opensearch-mcp-server-py for AOS/AOSS clusters
  with auto-install flow including endpoint and auth collection
- Fix MCP auto-install messaging to ask user to restart IDE

Refs: opensearch-project/observability-stack#119
Signed-off-by: Arjun kumar Giri <arjung@amazon.com>
ingestion, query logs with PPL, analyze error patterns, set up index
lifecycle policies, investigate traces, or check stack health. Activate
even if the user says log analysis, Fluent Bit, Fluentd, Logstash, syslog,
traceId, OpenTelemetry, or log analytics without mentioning OpenSearch.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Don't we want to mention Docling for ingestion in the description?

@saratvemulapalli
Copy link
Copy Markdown
Member

saratvemulapalli commented Mar 24, 2026

@arjunkumargiri Im ok with adding observability within the launchpad skill for now. But the more "sub"-skills we add it would complicate how IDE agents load them into context and add management overhead for us.
Ideally I would like to have dedicated skills per vertical and customers can use npx skills add opensearch-project/opensearch-launchpad in one go.

@owaiskazi19 owaiskazi19 merged commit 4e03a92 into opensearch-project:main Mar 25, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants