Sending Logs

A log records something that happened, such as an error. OpenSearch stores logs; OpenSearch Dashboards (called Kibana in some Saurons) lets you search them. First send two test records, then connect the program that sends your service's logs. New to these tools? Start with Explore your Sauron.

Retention: Searchable logs are kept for 7 days by default. Check Console → Instance for your configured period. You can request a different period. Older logs require recovery from available backups.

Send your first log event

NeedAn approved OpenSearch write account for this Sauron.
First actionPrepare two safe test events using the command below.
Done whenThe upload reports no event errors and a search returns both events.

Ask your Sauron owner if you need a write account. The example uses sauron-log-test as the index (where these records are stored). If that index already exists, choose a new test name and use it in all commands. Do not send real customer data. The commands show this Sauron's API username and prompt for its password; replace the username if your team has a different approved OpenSearch account.

Basic OpenSearch bulk test

Use this small test before configuring the program that sends production logs. The file format lets OpenSearch receive two events in one request; your regular log sender does not need this format.

1. Create two test events in sauron-log-test.json:

cat > sauron-log-test.json <<'EOF'
{"index":{"_id":"1"}}
{"message":"Sauron log ingestion test event 1","service":"sauron-doc-test","level":"INFO"}
{"index":{"_id":"2"}}
{"message":"Sauron log ingestion test event 2","service":"sauron-doc-test","level":"INFO"}
EOF
cat sauron-log-test.json

2. Send the file to OpenSearch:

curl --fail --show-error -u 'sauron' \
  -X POST \
  -H 'Content-Type: application/x-ndjson' \
  --data-binary @sauron-log-test.json \
  'https://elasticsearch.stage.apatil.developers.oracledx.com/sauron-log-test/_bulk?refresh=wait_for&pretty'
Check before continuing: Confirm the bulk response has "errors": false. A bulk request can return HTTP 200 while an event fails; inspect the items errors if this field is true.

3. Search for the test events:

curl --fail --show-error -u 'sauron' \
  'https://elasticsearch.stage.apatil.developers.oracledx.com/sauron-log-test/_search?pretty'

In the response, confirm the test events are returned. For example, look for:

"service" : "sauron-doc-test"

If the search returns the test events, this endpoint accepted them. It does not yet prove that your normal shipper works.

Prove it works before production

Agree on production index naming with the service and Sauron owners.

Repeat the first log test in the target environment. Then send one known event through your normal shipper and find that event in OpenSearch Dashboards. Confirm the shipper's index name, authentication, and time range before relying on production traffic.

Using FluentBit to send logs to OpenSearch

After the small bulk test works, ask your service owner which log shipper is approved and where it runs. Then:

  1. Choose a shipper and OpenSearch output plugin approved for your service.
  2. Set its output host to the OpenSearch endpoint for this Sauron.
  3. Choose an index name or pattern your team will recognize.
  4. Give the client the approved account or token through your normal secret store, not a checked-in configuration file.
  5. Send one known application log line, then find that exact line in OpenSearch Dashboards.

For FluentBit's exact output fields, use its OpenSearch output documentation. Check the installed client and plugin versions before copying an example.

Find logs in OpenSearch Dashboards or Kibana

After the test above, open OpenSearch Dashboards and open Discover. Select the index pattern for sauron-log-test. If none exists, open Management → Dashboards Management → Index patterns and create one matching sauron-log-test*. The sample events have no timestamp field; choose I don't want to use the time filter when asked. Return to Discover, select the new pattern, and search for sauron-doc-test. Both test messages should appear. If you cannot create a pattern, ask your OpenSearch Dashboards owner for access. For production logs, select your shipper's index pattern and widen the time range if a known event is missing. See OpenSearch's index-pattern guide if the menu wording differs on your version.

When finished, use DELETE /sauron-log-test in OpenSearch Dev Tools only if you created that index solely for this exercise. Use your chosen index name; ask its owner before deleting a shared index.

Tips and checks

  • Tips: Keep passwords and tokens out of logs. Agree on retention and expected volume before sending production logs.
  • Check: Search for a known test message. If missing, check the index or index pattern, time range, and sending client’s error. For bulk requests, inspect each item’s result, not just the HTTP status.