Content
Ops
> Claude CodeSearch MCP Server + Troubleshooting/Log Analysis Skills
**"Payment failure seems to have occurred around 5- on February 25th. Please check OpenSearch and identify the cause in the backend code."** — Analyze the the failure with this natural language request.
## Features
| Skill ||------|------|
| `/opensearch-ops:investigate` | Troubleshooting (Log + Code Analysis) |
| `/opensearch-search-logs` | Conditional Log Search |
| `/opensearch-ops:analyze-patterns` | Comparative Analysis of Log Patterns between Two Time Ranges |
| `/opensearch-ops:cluster-health` | Cluster Health Check |
### MCP Tools (Auto-connected)
The [opensearch-mcp-serverhttps://github.com/opensearch-project/opensearch-mcp) is automatically connected, making the following tools available:
- **SearchIndexTool** — Query DSL-based Search
- **LogPatternAnalysisTool** — Abnormal Pattern Detection between Baseline and Selection
- **DataDistributionTool** — Time-based Data Distribution Analysis
- **ListIndexTool** — Index List Retrieval
- **ClusterHealthTool** — Cluster Health Check
- **GenericOpenSearchApiTool** — Calling All OpenSearch APIs
## Installation
### One-click Installation
```bash
git clone https://github.com/nathankim0/opensearch-ops.git
cd opensearch-ops
chmod +x setup.sh && ./setup.sh### Installation from Marketplace
```bash
# Register in Marketplace
claude plugin marketplace add nathankim0/opensearch-ops
#
claude plugin install opensearch-ops
```
### Local
```bash
claude --plugin-dir /path/to/openseops
```
## Authentication Settings MCP Server uses **server-to**, which does not support browser-based authentication (Google OAuth, SAML, Choose one of the following three methods:
### Method 1: Basic Internal User (Recommended)
The simplest method. Create an API-d User in OpenSearch DashboardsCreation Method:** Dashboards → Security → Internal Users → Create internal user If you don't have admin privileges, request the infrastructure team:
> "Please create an Internal User for API OpenSearch with the `readall` role."
```bash
# ~/.zshrc or ~/.
export OPENSEARCH_URL="https://your-opensearch-cluster:9200"
export OPENSEARCH_USERNAME="mcp-reader"
export OPENSEARCH_PASSWORD="Issued Password"
export OPENSEARCH_SSL_VERIFY="true"
```
### Method 2 IAM Authentication (SigV4 IAM user/role mustSearch access permissions (`es:ESHttp*`).
```bash
export OPENSEARCH_URL="https://your-domain.ap-northeast-2.es.amazonaws.com"
export AWS_REGION="ap-northeast-2"
# AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY AWS_PROFILE needs to be set> **Caution:** Users without OpenSearch permissions, such as S3-dedicated IAM users, will result in a 403 error.
### Method 3: Self-managed OpenSearch
For self-managed clusters:
```bash
export OPENSEARCH_URL="https://localhost:9200"
export OPENSEARCH_USERNAME="admin"
export OPENSEARCH_PASSWORD="admin"
export OPENSEARCH_SSL_VERIFY="false" # For self-signed certificates
```
### Unsupported Authentication Methods
| Method | Support | Alternative |
|------|-----------|------|
| Basic Auth (Internal User) | **Supported** | — |
| AWS IAM (SigV4) | **Supported** | — |
| Google OAuth / SAML / OIDC | **Not Supported** | Create Internal User |
| Browser Token InterceptionNot Supported** | Create Internal User |
## Usage Examples
### Troubleshooting
```
/opensearch-ops:investigate Payment failures concentrated around 5-7 am on February 25th. Please check OpenSearch logs and identify the cause in the backend code.
```
### Log Search
```
/opensearch-ops:search-logs Search for ERROR level logs with the keyword "timeout" between 10 am and 11 am today.
```
### Pattern Comparison
```
/opensearch-ops:analyze-patterns Compare error patterns before deployment (February 24th, 2 pm-4 pm) and after deployment (February 24th, 4 pm-6 pm).
```
### Cluster Health
```
/opensearch-ops:cluster-health
```
## Structure
```
opensearch-ops/
├── .claude-plugin/
│ ├── plugin.json # Plugin Manifest
│ └── marketplace.json # Marketplace Metadata
├── .mcp.json # OpenSearch MCP Server Settings
├── skills/
│ ├── investigate/ # Troubleshooting (Main Skill)
│ │ └── SKILL.md
│ ├── search-logs/ # Log Search
│ │ └── SKILL.md
│ ├──s/ # Pattern Comparison Analysis
│ │ └── SKILL.md
│ └── cluster # Cluster Health
│ └── SKILL.md
├── # One-click Installation├── LICENSE
└── README```
## Requirements
- [ Code](https://claude.ai/code) (CLI)
- Python 3.10+ (uv or pip)
- Accessible OpenSearch## License
MIT
