dsh-client-ui-elasticsearch

Production logs tend to be scattered across multiple indices in an Elasticsearch cluster, and a single incident investigation can mean bouncing between the IDE, a browser, and the ES management UI, hand-crafting DSL queries and cross-referencing trace IDs one by one. This plugin moves that workflow directly into a DeepSeek Harness conversation: you fill in one or more ES URIs, a username, and a password in the Settings panel, and the connection details are stored in the shared DSH settings document so every session picks them up automatically.

Once configured, the session can call the es_query_logs tool in two ways. It accepts an exact trace_id lookup that runs term queries across trace_id, trace.id, traceId, and traceID fields, or a natural-language query (for example connection refused or NullPointerException) that performs a best_fields multi_match over message, exception, and other resolved log text fields. The two can be combined to narrow results from both the trace scope and the content match. The tool walks every configured URI in order, sorts hits by @timestamp descending, and caps a single page at 500 documents. A built-in system-prompt hint also nudges any session to invoke the tool whenever a trace ID or a log-related question appears, without needing a dedicated agent preset.

The plugin is aimed at developers and SREs who maintain online services with logs shipped to Elasticsearch. There is no DSL to memorize and no extra console to open: describe the symptom in plain language or paste a trace ID, and the conversation returns structured log entries, compressing what used to take minutes into a matter of seconds.