Elasticsearch Search & logs
Ask plain-English questions about your own Elasticsearch — search your logs and documents, inspect indices and mappings, and check cluster health — answered from live data.
Connect your Elasticsearch and Sauble can investigate against your real logs and documents — no Kibana to click through. It searches your data with full queries or ES|QL, counts what matches, reads each index's schema, and checks the health of the cluster behind it.
What Sauble can do
8 capabilities, grouped by what you are trying to find out.
Search & query your data
searchRun a full read-only query over an index and get back the matching documents — the workhorse.esql_queryRun an ES|QL query and get tabular results back — for filtering and aggregating in one expression.countCount how many documents match a query, without pulling every record back.Understand your indices
list_indicesEvery index with its health, document count and store size — the lay of the land.get_mappingsThe schema of an index — which fields exist and their types — so a query targets the right ones.get_index_statsDetailed stats for an index: doc counts, store size, and indexing/search rates.Check cluster health
cluster_healthThe green/yellow/red status, node counts, and how many shards are unassigned.cat_nodesEach node's heap, CPU and load, plus its role and whether it is master.Full read APIget_elasticreaches the rest of the Elasticsearch REST API, read-only — anything the curated tools don't cover.
Ask it things like
Natural language — Sauble picks the right tools for you.
How Elasticsearch organizes your data
The 5 things Sauble reads — and how they connect.
Cluster
The whole deployment, with an overall green/yellow/red status that summarizes everything below.
Nodes
The servers that make up the cluster, each carrying shards and reporting heap, CPU and role.
Indices
The named collections your data lives in — logs, metrics, app records — each with its own health and size.
Documents
The individual records inside an index — a log line, an event, a record — what a search returns.
Fields & mappings
The schema of an index — the fields a document can hold and their types — what you can query on.