07 September 2026
My First VS Code Extension: A Query Tool for OpenSearch PPL
Working with OpenSearch to build a Splunk replacement, I did not find a good environment for working on queries. The Dashboard and its Discover component are clearly intended to replace Splunk’s front end, but I found them buggy and less functional. For developing Lucene queries, search request clients like cURL and Bruno work well, and you can have the JSON you’re posting open in your IDE, with your results visible to your coding assistant. For log analysis, dashboards, and reports, PPL (Pipe Processing Language) is more comfortable (though not as comfortable as SQL, whose implementation is more of a proof of concept than a functional tool), but to move your work to the IDE, your queries need to be escaped into JSON wrappers, which is an uncomfortable way to work.
Part 1 of the solution was to build a command-line utility for posting PPL. The Query Workbench in the Dashboard’s DevTools can do roughly that, but it is GUI-only and lacks a means to save queries for reuse.
Part 2 is the extension for VS Code. This came about purely by asking coding assistants what they could do. Writing the extension by myself is beyond my skills. The CLI, although 96% written by AI, was highly supervised; with the extension, I accepted or rejected what the AI did. This is the first time I’ve released something that I consider vibe-coded. I’ve done so because it’s useful.
The tools allow comments in PPL, not part of the spec, but very valuable when you’re saving a scrapbook of queries to reuse. The extension offers syntax highlighting, and suggests PPL keywords as you type. The results pane (which you can configure to be at the bottom or to the side) displays results in colors making it easy to follow, and the display can be switched to rainbow background, striped, or just plain text. You can also set max column width when using both the Extension and the CLI. Clicking on a result in the extension brings up a detail display. When you add a coding assistant it becomes a powerful development environment.
If you’re working with OpenSearch please give it a try. And don’t forget to rate it.