OpenSearch advances observability with new alerting tools for large-scale operations

OpenSearch, a Linux Foundation top-level project with backing from AWS and other major sponsors, is extending its Observability Stack with new tools designed to streamline alerting at scale. The platform integrates AI agent tracing, application performance monitoring, service maps, logs, metrics, and dashboards in one OpenTelemetry-native environment, now enhanced with ML-based anomaly detection capabilities.

The alerting problem at scale#

Modern observability teams face a critical mismatch: they have more telemetry than ever before, but the tools available to act on it haven't evolved accordingly. As AI agents introduce new, high-volume signals into existing monitoring pipelines, the gap continues to widen. According to the Linux Foundation, 77% of organizations now consider OpenSearch a core or supporting component of their AI infrastructure, often specifically to track agent activity.

The challenges mount quickly: traditional query languages designed for simple threshold-based rules falter when trying to correlate signals across multiple sources, alert configurations scatter across disconnected systems, and on-call engineers waste hours filtering through false positives instead of focusing on actual incidents.

New capabilities: PPL and unified alerting#

To address these gaps, the OpenSearch team is introducing Piped Processing Language (PPL) for alerting, along with a unified Alert Manager.

PPL brings the familiar Unix pipeline model into observability work. Engineers can now filter, transform, and correlate data across logs, metrics, and traces using straightforward, human-readable syntax. By chaining steps together much like commands at a terminal, teams can construct multi-step alert conditions that detect subtle failure patterns—for instance, a latency spike in an AI agent's tool call that only becomes relevant when concurrent log error rates also rise. Because PPL skills transfer across search, analytics, and alerting tasks, teams can maintain complex alert conditions more easily and share them across the organization.

The new Alert Manager provides a single interface for defining alert rules, managing routing logic, suppressing duplicate signals, and handling escalation paths. This centralized approach aligns how alerts are supposed to flow on paper with how teams actually respond in practice.

Both capabilities ship under the .