Cross-Source Dashboard

Dashboards in OpenSearch UI can combine visualizations from different data sources on a single page. This lets you build unified operational views that correlate logs, traces, metrics, and security events — even when the data lives on separate OpenSearch domains or serverless collections.

Each visualization on a dashboard is tied to an index pattern, and each index pattern is tied to a specific data source. By placing visualizations from different index patterns (and therefore different data sources) on the same dashboard, you create a cross-source view.

The global time picker and dashboard-level filters apply to all visualizations simultaneously, making it easy to investigate issues across data sources within the same time window.

Before building a cross-source dashboard:

1. Multiple data sources associated with your application (see Connect Data Sources)
2. A workspace with access to all the data sources you want to visualize
3. Index patterns created for each data source within the workspace

Navigate to Dashboards Management → Index Patterns and create patterns for each source:

Build visualizations that each target a specific index pattern:

Visualization 1: Error rate over time (logs-domain)

1. Go to Visualize → Create visualization
2. Choose Line chart
3. Select the app-logs-* index pattern
4. Configure:
   • Y-axis: Count, filtered by status_code >= 500
   • X-axis: Date histogram on @timestamp
5. Save as "Error Rate - Logs"

Visualization 2: P99 latency (apm-domain)

1. Create a new Line chart
2. Select the traces-* index pattern
3. Configure:
   • Y-axis: Percentile (99th) on duration
   • X-axis: Date histogram on startTime
4. Save as "P99 Latency - Traces"

Visualization 3: Security alert count (siem-domain)

1. Create a new Metric visualization
2. Select the security-events-* index pattern
3. Configure:
   • Metric: Count, filtered by severity: HIGH OR CRITICAL
4. Save as "Critical Security Alerts"

Visualization 4: Top error services (logs-domain)

1. Create a new Data table
2. Select the app-logs-* index pattern
3. Configure:
   • Metric: Count
   • Bucket: Terms on service_name
   • Filter: status_code >= 500
4. Save as "Top Error Services"

1. Navigate to Dashboards → Create dashboard
2. Click Add and select each visualization you created
3. Arrange the panels by dragging and resizing
4. Set the global time range using the date picker
5. Save the dashboard as "Operations Overview"

Dashboard filters apply to all visualizations that have the matching field:

1. Click Add filter in the filter bar
2. Add a filter like region: us-east-1
3. Visualizations that have a region field will filter accordingly
4. Visualizations without that field are unaffected

Add a Controls visualization to your dashboard for interactive filtering:

1. Create a new Controls visualization
2. Add an Options list control for a field like service_name
3. Add a Range slider control for a field like response_time
4. Save and add to your dashboard

Controls create dropdown menus and sliders that filter all visualizations on the dashboard in real time.

Organize panels into visual sections by data source:

Use Markdown panels as section dividers:

Ensure all index patterns use a time field so the global date picker works across all panels. If an index pattern doesn't have a time field, that visualization won't respond to time range changes.

Dashboards with too many panels can be slow to load, especially when querying multiple data sources. Aim for 10-15 panels per dashboard. For more complex views, create multiple dashboards and link between them.

You can save frequently used filter combinations:

1. Apply your filters in the filter bar
2. Click the Save icon next to the search bar
3. Name the saved query (e.g., "US-East Production Errors")
4. Load it later from the same menu

Saved queries apply across all visualizations on the dashboard, regardless of data source.

1. Click Share in the top navigation
2. Choose Short URL
3. Copy and share the link — recipients need application access

1. Click Share → PDF Reports or PNG Reports
2. The report captures the current dashboard state including all cross-source panels
3. Reports are generated asynchronously — check Reporting for status

Dashboards can be embedded in iframes if your application allows it. The embedded view respects the same authentication requirements.

• No cross-source joins in visualizations — Each visualization queries a single index pattern. You cannot create a visualization that joins data from two different data sources.
• Field name mismatches — Dashboard filters only work if the field name exists in the index pattern. If one source uses timestamp and another uses @timestamp, a filter on one won't affect the other.
• Performance varies by source — Panels querying a heavily loaded domain may be slower than others. The dashboard loads panels independently.
• Direct query panels are slower — Visualizations backed by S3 or CloudWatch direct query sources take longer to render than those backed by indexed data.

• Check that the time range covers data in all data sources
• Verify the index pattern is associated with the correct data source
• Confirm the index exists and has data in the selected time range

• Reduce the number of panels or split into multiple dashboards
• Check if any data source is under heavy load
• Use shorter time ranges for initial loads
• Consider pre-aggregating data for frequently viewed dashboards

• The filter field must exist in each visualization's index pattern
• Check for field name differences across data sources (e.g., host vs. hostname)
• Verify the filter syntax is correct in the filter bar

• The index pattern for that panel may not have a time field configured
• Edit the index pattern and set the correct time field
• Panels using Metric or Markdown types may not be time-dependent