Run a log chart
run_log_chartAggregates the project's logs into a chart and returns a compact summary: per series min/max/avg/last and up to max_points points, a table (up to 50 rows) or a single value. HPL = <search> | <aggregations> [by <fields>] [every <interval>] [compare <1h|1d|1w|4w>] [| eval <alias> = <formula>] [| sort <alias> asc|desc] [| limit <n>] [| table|scalar]. Search: the Logs language (service:api, level:>=warn, attr.:value, value lists field:(a|b), "phrase", -word; no OR). Aggregations: count(), count_if(), count_distinct(f), sum/avg/min/max(f), p50/p75/p90/p95/p99(f), rate(), histogram(f, n); as <alias>. Fields: service, host, environment, level, source, pattern, attr., resource.. Intervals: auto, 10s … 1d. Examples: level:>=error | count() by service every 5m · attr.http.route:* | p95(attr.duration_ms) as p95, count() as n by attr.http.route | sort p95 desc | limit 10 · service:api | count_if(level:>=error) as err, count() as all | eval rate = err / all * 100 | scalar · | count() by level compare 1d. Pass hpl (text) or spec (a ChartSpec JSON object), not both. Never SQL. The engine reads the per-minute rollup or a derived metric when it can (meta.engine.planner), raw lines otherwise.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End. Default now. | |
| hpl | No | The chart as HPL, e.g. `level:>=error | count() by service every 15m compare 1d`. | |
| from | No | Start. Default 1h ago. ISO 8601, epoch ms, or relative (15m, 1h, 24h, 7d, 90d). Raw lines answer up to 7 days; counts by service/level and derived metrics up to 400 days. | |
| spec | No | The chart as a ChartSpec v1 object ({v: 1, filter, aggregations, formulas, group_by, interval, compare, having, sort, limit, output}). | |
| variables | No | Dashboard variables the chart reads, e.g. {"service": ["api", "web"]}. An unset variable drops its term. | |
| max_points | No | Points per series. Default 60 (thinned evenly, last kept). | |
| max_series | No | Series to return. Default 10. |