Docs / Connections: Elasticsearch and OpenSearch

Ask Elasticsearch or OpenSearch

Attach a cluster and ask. Verbiqo reviews it, samples it live, and analyzes and rewrites queries, without reading a document.

Attach

Type /es and the connection’s name, as you saved it in Set up. For a connection named logs:

/es logs

Then ask in your own words. Every question below is for typing as it is.

What to ask

A question that carries a query is about that query; the cluster is reviewed too only when the question also mentions the cluster, nodes, shards, disk or heap. Every check: Elasticsearch and OpenSearch checks.

How it reads the cluster

• Corrected requests: when Elasticsearch refuses one of the model’s requests for a mistake Verbiqo recognises (a sort the table has no column for, a parameter the API does not take, a data stream’s backing index without its leading dot), Verbiqo corrects it once, asks again, and says so above the result.
• Findings once: the findings and recommendations are shown in full with the first answer. When the next answer’s are the same, a line names them instead; ask to review the cluster to see them in full again.
• Logons and leaked credentials are read from log indices you name on the connection (Security logs). Without them, Verbiqo says so and how to add them, rather than looking for logons in the cluster’s metadata.

Paste a query

Why it helps: it explains why one search is slow, or wrong, and gives it back rewritten, without running it on your data.

Type your question, then paste the search under it. JSON on its own, a request, or a slow log line all work:

Why is this slow?
GET products/_search
{ "query": { "bool": { "must": [ { "wildcard": { "name": "*shirt" } } ] } }, "from": 9000, "size": 50 }

The answer lists the problems (speed and correctness), then the query, rewritten, with each change named. Test it on the same data before using it: where the original was wrong, results differ on purpose.

Why a value is not found

Why it helps: it shows, from the cluster’s own analyzers, why a value you know is there is not found, so you fix the mapping or the query instead of guessing.

Ask Why doesn’t this find "Red Shirt"? and paste the query under it, with the value you expected in quotes.

Verbiqo answers per field, like this (its reply, not something to type):

match on name (text, analyzer standard): searches for [red] [shirts], all of them.
"Red Shirt" does not match: the value becomes [red] [shirt]; [shirts] is not among its terms.

It uses validation with explain, so the field’s real analyzer applies, no document is read, and the monitoring role is enough.

What happened earlier

Why it helps: the cluster shows its state now; the server logs show what led to it, so an incident can be traced in order.

Attach the logs and the cluster in the same chat (here a Splunk connection named prod):

/splunk prod
/es logs

Ask What happened on the cluster yesterday?

Splunk adds health changes, nodes leaving, master changes, GC, watermarks, and slow searches grouped by shape, the slowest analyzed (Log findings).

How the answer is checked

Why it helps: it tells you which parts of an answer Verbiqo read and checked, so you know what to verify before you change anything.

The model writes the answer; Verbiqo checks it before you see it.

• Figures. A figure about the cluster that nothing Verbiqo read contains (a heap percentage, a count) is sent back once to be removed or called an assumption. If it stays, the answer ends with Not measured: …. Advice (“keep heap at most 31 GB”), commands and a share worked out from two figures that were read are not flagged.
• What Verbiqo established. An answer may not contradict it: that a version is released and the supported upgrade path; whether it is still rebalancing (or that this could not be read); what the deprecation log said (or that it was not read); heap called high when no node is at 85%; and settings. A setting the answer names must be one the cluster has, and a default it states must be the cluster’s own (from its settings list, read with their defaults), so a setting from an old version or an invented default is caught. A contradiction is sent back once; if it stays, Verbiqo removes those sentences, keeps the rest of the answer, and says what it read in their place.
• Findings. As for every system: an answer cannot call the cluster healthy above a warning, raise a finding’s severity or rewrite its statement.

From a terminal

The same readings without a chat, for scripts or a quick look:

verbiqo es review logs
verbiqo es analyze logs --file query.json --index products
verbiqo es run logs shards
verbiqo es request logs "GET _cat/shards?s=store:desc"

• analyze takes the search as JSON from --file or standard input; --index names the index when the JSON does not. It validates and profiles the search on the cluster (with read on the index); --no-profile validates only, for a cluster you would rather not load.
• request sends one read request from Verbiqo’s allowlist, as a question would; anything that writes or administers is refused before it is sent.
• verbiqo es help lists the reports for run; --json works on every verb.