Summarize log errors
summarize_log_errorsGroups the project's errors (or warnings) of a time window by message pattern (numbers, ids and IPs normalized), most frequent first: count, share, trend (>1 = rising in the last quarter of the window), level, services, hosts, first/last seen, one sample. Computed from the stored lines, no AI. Follow up with search_logs pattern:<hash>.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End. Default now. | |
| from | No | Start. Default 1h ago. ISO 8601, epoch ms, or relative (15m, 1h, 24h, 7d). Window at most 7 days, within the last 30 days. | |
| limit | No | Patterns to return. Default 20, max 50. | |
| query | No | Extra filter, e.g. `service:api`. Logs search language (not SQL): free words are ANDed (whole words), "exact phrase", -word to exclude, service:api, host:web-1, env:prod, source:src_…, level:error or level:>=warn, attr.<key>:value, trace:<id>, pattern:<hash>, word* for a prefix. OR is not supported. | |
| min_level | No | Lowest level counted. Default error. |