Using Discover for observability

Introduced 3.5

OpenSearch provides interfaces that work together with datasets and correlations to provide a comprehensive observability experience, enabling you to quickly identify issues, understand system behavior, and troubleshoot problems across your distributed applications.

Specialized interfaces are available for exploring the three pillars of observability data:

• Logs: Query and analyze log data using Piped Processing Language (PPL).
• Metrics: Explore time-series metric data using PromQL queries.
• Traces: Investigate distributed traces and span relationships.

Prerequisites

To use these data exploration features, you need to:

• Create an observability workspace: These features are only available within Observability workspaces. To learn how to enable and create workspaces, see Workspace for OpenSearch Dashboards.
• Enable feature flags: Configure the required settings in your opensearch_dashboards.yml file. Each feature page provides the specific configuration needed.
• Configure data sources: Set up appropriate data sources for your logs, metrics, and traces. For configuration guidance, see Data sources.

Creating an observability workspace

To create an observability workspace, follow these steps:

1. Enable workspaces. For more information, see Enabling workspaces.
2. On the OpenSearch Dashboards home page, select Create Workspace and choose Observability. Alternatively, select the plus sign on the Observability card to create a new observability workspace.
3. In Workspace details, enter a Name and optional Description for your workspace.
4. Select Observability as the use case and then select Create workspace.

For detailed instructions, see Create workspace.

Getting started

After creating an observability workspace, follow these steps to get started:

1. Datasets – Learn how to organize your observability data into manageable datasets.
2. Discover logs – Explore log data using PPL queries and visualizations.
3. Discover traces – Analyze distributed traces and span relationships.
4. Discover metrics – Query and visualize time-series metrics using PromQL.
5. Correlations – Understand how to link trace and log datasets for unified analysis.