Is your feature request related to a problem? Please describe.
A search with Lucene (query search/wildcard) provides the list of events which contain the keyword. It does not allow analysts to obtain aggregated results or to perform extraction or transformation as part of the investigation process to get more precise results. Analysts who need those answers today can query OpenSearch directly, which loses the sketch scoping, the ACL check and the timeline filter along the way — and the results can't be pivoted back into the timeline.
Describe the solution you'd like
Expose PPL and SQL from the Opensearch plugin, as additional search modes in the Explore view, scoped to the sketch's own indices.
- PPL and SQL join Query String and Wildcard in the existing search-mode selector, so there's one place to choose how a search is written.
- Results come back as a table, and any cell can be pivoted into the events behind it, handing the language back to Lucene.
- Queries are read-only, and every query is scoped to the sketch's indices server-side; a query naming an index outside the sketch is refused.
- The modes appear only when the cluster can serve them, in the same way wildcard search is offered only where the mappings support it.
Describe alternatives you've considered
- Aggregations API. Timesketch already has one, but it answers a fixed set of shapes chosen ahead of time. The cases above are ad hoc, and an analyst can't express a join or a multi-stage pipeline through it.
- Querying OpenSearch directly outside Timesketch. This bypasses the ACL and sketch scoping, and the results live outside the case.
- A separate query console, distinct from the search bar. Rejected because the language and the search mode would be two controls that can disagree.
Additional context
I have a working implementation and will open a draft PR against it for early feedback. Note it requires OpenSearch 3.7.0 or later, for reasons described in the PR.
Is your feature request related to a problem? Please describe.
A search with Lucene (query search/wildcard) provides the list of events which contain the keyword. It does not allow analysts to obtain aggregated results or to perform extraction or transformation as part of the investigation process to get more precise results. Analysts who need those answers today can query OpenSearch directly, which loses the sketch scoping, the ACL check and the timeline filter along the way — and the results can't be pivoted back into the timeline.
Describe the solution you'd like
Expose PPL and SQL from the Opensearch plugin, as additional search modes in the Explore view, scoped to the sketch's own indices.
Describe alternatives you've considered
Additional context
I have a working implementation and will open a draft PR against it for early feedback. Note it requires OpenSearch 3.7.0 or later, for reasons described in the PR.