Investigate indexed application errors
Search a log index for a specific order or request identifier and let the AI explain the returned sequence of events.
APIs & logs · MCP integration
Search OpenSearch logs with AI through a scoped MCP endpoint.
Use the OpenSearch backend of GateRook’s Logs connector to investigate indexed log events. Configure the permitted index patterns, timestamp and message fields, then let the AI search with Lucene query syntax through logs_search.
Connection in GateRook
stage-search-logs
OpenSearch
stage / QA- Connector type
- OpenSearch
- Name / environment
- stage-search-logs / stage
- URL
- https://search.stage.internal
- Indices
- logs-orders-*
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Find recent order 48213 errors in OpenSearch and explain the sequence.
logs_search · arguments
{
"connection": "stage-search-logs",
"query": "message:48213 AND log.level:ERROR",
"from": "-15m",
"to": "now",
"limit": 20
}Example result
{
"backend": "opensearch",
"entries": [
{
"timestamp": "2026-10-22T12:29:00Z",
"severity": "ERROR",
"message": "Payment authorization timed out for order 48213"
}
],
"count": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with OpenSearch and AI
Adapt to an existing log schema
Map the connector’s timestamp, message, severity and label fields to the fields your pipeline already writes.
Connect an AWS-hosted deployment
Use awsSigV4 authentication with the appropriate es or aoss service setting and credentials authorized for the deployment.
From service to MCP
How to connect OpenSearch
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select Logs. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Identify the log index mapping
Choose the log indices and check the timestamp, message, severity and label fields. This integration is designed around log events rather than arbitrary index administration.
Configure endpoint and authentication
Open Connections, Add connection and OpenSearch. Set the URL and allowed indices. Choose the authentication mode supported by the deployment; for AWS signing, configure the AWS region, service and source credentials.
Restrict the query and test
Set a fixed scope query if needed, configure any private CA, then run Test connection. Complete Add to endpoint and verify a short Lucene search in Playground.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure OpenSearch in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | OpenSearch | A Logs backend for searching log indices. |
Name / environment | stage-search-logs / stage | A dedicated log connection, separate from other environments. |
URL | https://search.stage.internal | The OpenSearch service origin, without a dashboard path. |
Indices | logs-orders-* | Only the selected index patterns are exposed. Cross-cluster patterns are not supported. |
Timestamp / message / severity fields | @timestamp / message / log.level | Map these to the actual fields in your log documents. |
Credentials mode | basic | Available modes are none, basic, apiKey, bearer and awsSigV4. Enter the credential in GateRook. |
Always add this query | service.name:orders | Optional fixed Lucene query combined with the agent query. |
Know what you expose
OpenSearch tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
logs_search | Search a bounded time range in the backend query language, with a cursor for older results. | Read only |
logs_tail | Read new log entries since a cursor, waiting up to eight seconds for another page. | Read only |
Before you enable access
- This integration reads logs. It does not edit entries, change retention or administer the logging service.
- The connection scope, environment policy and result limits all apply. A truncated page is only part of the evidence.
- Log messages may contain application data or sensitive payloads. Scope the source and review the data your AI app is permitted to receive.
- This is a log-search integration, not an arbitrary OpenSearch request or index-management tool.
- Queries use Lucene query_string syntax. Indices are restricted to the connection’s patterns; cross-cluster patterns are excluded.
- Choose authentication supported by your server. Native OpenSearch API-key support depends on server capabilities; the schema documents OpenSearch 3.7 or later for that mode.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
OpenSearch connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Can the AI create or delete an index?
No. This Logs backend only publishes logs_search and logs_tail. It does not expose index administration.
Is the example Elasticsearch documentation?
No. This guide describes the OpenSearch backend implemented in GateRook. It does not promise compatibility with every Elasticsearch deployment.
What if my logs use different field names?
Configure the timestamp, message, severity and label fields to match your indexed documents before testing the connection.
Keep exploring
Connect the rest of your stack
Loki
Connect Loki to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
AWS CloudWatch Logs
Connect AWS CloudWatch Logs to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
HTTP API
Connect a REST or HTTP API to AI through MCP. Scope base URLs and paths, keep API keys in GateRook, and approve requests that change data.
Your infrastructure, on your terms
Bring OpenSearch into the conversation.
Start with one connection. Choose what your AI can do.