菜单
Elasticsearch provider for obz. Supports log search and trace operations using Elasticsearch Query DSL (Lucene-based). Requires --index flag. This skill should be used when the user mentions "Elasticsearch", "obz -p es", or needs to search logs or traces from an Elasticsearch cluster.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | obz-elasticsearch |
| description | Elasticsearch provider for obz. Supports log search and trace operations using Elasticsearch Query DSL (Lucene-based). Requires --index flag. This skill should be used when the user mentions "Elasticsearch", "obz -p es", or needs to search logs or traces from an Elasticsearch cluster. |
| Field | Value |
|---|---|
| Aliases | es, elasticsearch |
| Signals | Log, Trace |
| Query language | Elasticsearch Query DSL (Lucene-based) |
| Auth | Basic auth, bearer token, or API key (in config.yaml) |
| Provider flags | --index (required at runtime) |
| Supported cmds | log search, trace search, trace get |
obz log search # Search log entries in an Elasticsearch index
obz trace search # Search trace spans in an Elasticsearch index
obz trace get # Retrieve a trace by ID from Elasticsearch
| Flag | Type | Required | Description |
|---|---|---|---|
--index | String | Yes | Index name or pattern to query |
The --index flag is declared optional at the clap level (so other
providers don't error), but Elasticsearch enforces it at runtime.
Configure auth in config.yaml under providers.<name>.auth.
Priority: API key > bearer token > basic auth.
Basic auth:
# config.yaml
providers:
es:
endpoint: https://es.example.com
index: logs-*
auth:
username: elastic
password: ${env:ES_PASS}
Bearer token:
auth:
token: ${env:ES_TOKEN}
API key (Authorization: ApiKey <key>):
auth:
api-key: ${env:ES_API_KEY}
Then query with just -p:
obz log search -p es -q 'level:ERROR' --from now-1h
Elasticsearch accepts Lucene-based query strings in the -q parameter.
The syntax is nearly identical to OpenSearch.
level:ERROR # field match
level:ERROR AND service:api # boolean AND
status:(404 OR 500) # grouped OR
message:"connection refused" # phrase match
host:web-* AND NOT path:/health # wildcards and negation
response_time:[500 TO *] # range query
*error) are disabled by default for performance.Both providers share the same query syntax and flag surface. The main difference is the backend API version and endpoint format.
| Aspect | Elasticsearch | OpenSearch |
|---|---|---|
| Alias | es | os |
| Auth options | Basic + bearer + API key | Basic + bearer |
| API lineage | Elastic N.V. | AWS fork |
If your cluster is OpenSearch, use the os provider instead.
Search logs by level:
obz log search -p es --index 'logs-*' -q 'level:ERROR' --from now-1h
Search with boolean operators:
obz log search -p es --index 'app-logs' \
-q 'service:api AND status:500' --from now-6h
Search traces:
obz trace search -p es --index 'traces-*' -q 'service:frontend' --from now-1h
Retrieve a specific trace:
obz trace get -p es --index 'traces-*' abc123def456
GreptimeDB provider for obz. Covers PromQL metric query, labels, label-values, and series commands via GreptimeDB's Prometheus-compatible API. Use this skill when the user mentions "GreptimeDB", "Greptime", "obz metric -p greptimedb", or needs to query metrics stored in a GreptimeDB instance.
Multi-backend observability CLI for querying metrics, logs, and traces across 12 backends. This skill should be used when the user runs obz commands, constructs metric/log/trace queries, configures providers, parses obz JSON output, or troubleshoots obz errors. Covers all core commands (metric query/list/info/labels/label-values/series, log search, trace search/get), global flags, time formats, output modes, config files, and exit codes.
Datadog provider for obz. Supports metrics (Datadog Query Language), logs (Datadog Log Query), and traces. Requires api-key and app-key configured under auth in config.yaml. Does not support metric labels, label-values, or series commands. This skill should be used when the user mentions "Datadog", "DD", "obz -p dd", Datadog Query Language, or needs to configure Datadog provider instances with regional endpoints.
Jaeger provider for obz. Covers trace search, trace retrieval by ID, and extension commands for service and operation discovery. This skill should be used when the user mentions "Jaeger", "obz trace -p jg", or needs to search distributed traces from a Jaeger backend.
Grafana Loki provider for obz. Covers log search using LogQL, a label-based query language for log aggregation. This skill should be used when the user mentions "Loki", "Grafana Loki", "LogQL", "obz log search -p loki", or needs to search logs from a Loki instance.
Grafana Mimir provider for obz. Covers all 6 metric commands using standard PromQL. Mimir is a horizontally-scalable Prometheus-compatible TSDB. This skill should be used when the user mentions "Mimir", "Grafana Mimir", "obz metric -p mimir", or needs to query metrics from a Mimir cluster.