OpenSearch Dashboards

UI for exploring data in the Anomalous Vectors OpenSearch stack. For the OpenSearch ingest API and client destinations, see OpenSearch.

After data is indexed

When documents exist in OpenSearch, Dashboards is is a great place to start analysis. One can:

Define index patterns (or data views, depending on Dashboards version) so fields and time ranges resolve correctly
Browse and filter records in Discover (Lucene or DQL)
Inspect structured fields

Need be, accept the browser warning for the local self-signed certificate. Sign in as admin with the OpenSearch admin password from first start (Home - Admin password).

Useful Endpoints

Context	URL
Login	https://127.0.0.1:5601/app/login
Index patterns	https://127.0.0.1:5601/app/management/opensearch-dashboards/indexPatterns
Discover	https://127.0.0.1:5601/app/data-explorer/discover

Recommended sequence

Confirm indexes and document counts on the OpenSearch API (_cat/indices, _count).
Create an index pattern whose title matches the index (or expression) you care about.
Set the time field to the timestamp your documents actually use (chosen by the ingest tool, not by this stack).
Open Discover, select that pattern, and adjust the time range until events appear.

If you create patterns before any matching indexes exist, Discover may error until data appears. Prefer creating patterns after at least one successful ingest, then refresh field lists if mappings evolve.

Create an index pattern in the UI

Reference: https://docs.opensearch.org/latest/dashboards/management/index-patterns/

Navigate to https://127.0.0.1:5601/app/management/opensearch-dashboards/indexPatterns.
Click 'Create index pattern'
Enter the index name or pattern (for example YOUR_INDEX or a prefix expression).
Choose the correct time field, then create the pattern.
Return to Discover; the index should be searchable and responsive to refresh.

Create an index pattern via API (file form)

Write index-pattern.json (adjust title, pattern id, and timeFieldName to match your data):

{
  "attributes": {
    "title": "YOUR_INDEX",
    "timeFieldName": "meta.indexed_at",
    "fields": "[{\"name\":\"meta.indexed_at\",\"type\":\"date\",\"esTypes\":[\"date\"],\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]"
  }
}

curl -sk -u admin:admin \
  -X POST "https://127.0.0.1:5601/api/saved_objects/index-pattern/YOUR_INDEX?overwrite=true" \
  -H "osd-xsrf: true" -H "Content-Type: application/json" \
  --data-binary "@index-pattern.json"

List patterns:

curl -sk -u admin:admin -H "osd-xsrf: true" \
  "https://127.0.0.1:5601/api/saved_objects/_find?type=index-pattern&per_page=100"

Delete a pattern (by saved-object id):

curl -sk -u admin:admin -X DELETE \
  "https://127.0.0.1:5601/api/saved_objects/index-pattern/YOUR_INDEX" \
  -H "osd-xsrf: true"

Example: Burp Exporter default index names (optional)

Burp Exporter documents default index names such as tool-burp-traffic, tool-burp-findings, tool-burp-sitemap, tool-burp-settings, and tool-burp-exporter. Use the file-based pattern above once per index (set title / URL id accordingly, with time field meta.indexed_at when that is what the exporter writes).

Exporter destination authentication and TLS options belong in the Burp Exporter wiki. If you create patterns before any matching indexes exist, Discover may error until data appears. Prefer creating patterns after those indexes have received data at least once, then refresh field lists if mappings evolve.

Then open Discover: https://127.0.0.1:5601/app/data-explorer/discover.

Known limits

Proxy traffic and similar corpora often include large string fields (for example full HTTP bodies), which can make Discover slow or hit response size limits.

This image sets OpenSearch Dashboards doc_table:highlight to false (uiSettings.overrides in the baked config). That disables Discover document-table search-term highlighting (and the heavy highlight payloads those requests can produce on nested body fields). It does not disable all highlighting in the product. Indexed fields remain searchable; only that Discover table highlight behavior is turned off.

OpenSearch also raises the per-string JSON parse ceiling via OPENSEARCH_JAVA_OPTS (-Dopensearch.json.max_string_length=200000000 in .env.example). Raise it further only if API or Discover responses still hit Jackson StreamReadConstraints limits.

Navigation Menu

Repository navigation