Skip to main content
Glama

logs

Find logs matching filter criteria within a time range.

Use this as your default starting point for log queries. Returns logs sorted by (timestamp, logId) descending (newest first).

Returns the log's main fields by default; pass verbose=true to include its attributes (http/url/… flattened in, plus a resource object). Long string values are capped (maxStringChars). For raw columns or custom selection use run_sql. For the full untruncated body of one row, use get_log.

Defaults: from/to: open window if omitted — beware of unbounded scans limit: 100 (max 1000) service/level: any

Common patterns:

  • Errors in the last hour: level="ERROR", from=<1h ago>

  • Logs for a trace: traceId="abc123..."

  • Whole-token search (case-insensitive): messageContains="timeout"

  • Substring or regex search: not supported here; use run_sql

Returns: logs: array of log objects (lean unless verbose=true) nextCursor: opaque token (null on the last page); pass back as cursor to fetch the next page explorerUrl: shareable Fixter UI link opening this query in the log explorer — attach it when citing these logs as evidence to the user (covers the service/level/traceId filters and the window; timestamps display in the viewer's browser timezone) queryStats: rowsReturned, elapsedMs

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
toNoEnd of time window, ISO-8601 instant (exclusive)
fromNoStart of time window, ISO-8601 instant (inclusive)
levelNoFilter by log level: TRACE, DEBUG, INFO, WARN, ERROR
limitNoMax logs to return, default 100, max 1000
cursorNoOpaque cursor from a previous response's next_cursor
serviceNoFilter by service name (e.g. 'investigation-service')
traceIdNoFilter to a single trace id
verboseNoInclude the row's attributes (flattened in, plus a `resource` object). Long string values are still capped (maxStringChars) either way. Default false.
maxStringCharsNoMax characters of any string value (message or attribute) before truncation. Omit to use the server default.
messageContainsNoWhole-token match on the message, case-insensitive. 'time' does not match 'timeout'. A term containing separators requires each of its tokens to be present. For substring or regex matching use run_sql

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations were provided, so the description carries the full burden—and it does so thoroughly. It discloses sorting order, default field selection, verbose behavior, string truncation, open time-window warning, pagination (nextCursor), and the explorerUrl semantic (sharing/citing evidence). This substantially exceeds the schema's mechanical descriptions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, scannable, and every section adds value: one-line summary, default-start recommendation, return field summary, defaults, and common patterns. Despite the length, it avoids fluff and organizes information for efficient agent parsing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a rich 10-parameter tool with no output schema and no annotations; the description covers function, time-range semantics, limits, unsupported behavior, and all relevant return fields including pagination and explorerUrl. It is complete enough to confidently invoke and correctly select it among 50+ sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so per calibration baseline is 3; the description adds meaning beyond the schema for some parameters (e.g., default from/to open window, limit max, messageContains whole-token semantics and run_sql alternative). It does not explain cursor/verbose/maxStringChars in much depth beyond the schema, but the usage patterns elevate it above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool finds logs matching filter criteria within a time range, and distinguishes it from siblings by noting it is the default starting point for log queries. It also explicitly names alternatives (run_sql for raw columns/custom selection, get_log for full untruncated body), resolving ambiguity among log-related siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance ('default starting point for log queries') and excludes alternatives for substring/regex or raw columns, with named alternatives: run_sql and get_log. Common patterns show concrete scenarios (errors in last hour, trace id, whole-token search), plus behavior such as open time window and limit defaults.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.8/5.0
Disambiguation2/5

Several tool pairs are near-duplicates, including three deprecated aliases (add_investigation_alert_channel vs add_alert_channel, list_investigation_alert_channels vs list_alert_channels, remove_investigation_alert_channel vs remove_alert_channel) that muddy the surface. Additionally, suppress_signal and create_ignore_rule both suppress alerting via different mechanisms, which could cause misselection despite detailed descriptions.

Naming Consistency4/5

The vast majority of tools follow a clear verb_noun snake_case pattern (create_api_test, list_issues, set_alert_rule_status). A few bare-noun tools (logs, spans, metrics) and the standalone verb correlate break the pattern slightly, but overall the naming is highly consistent and predictable.

Tool Count1/5

With 52 tools, this is on the extreme end of the calibration scale. Even accounting for the broad scope of an observability platform, the count is excessive and includes several deprecated redundancies that inflate it further.

Completeness5/5

The toolset provides comprehensive CRUD/lifecycle coverage across all major domains: alert rules (create, read, update, delete, status, delivery, preview), API tests (create, read, update, delete, run history, credentials), ignore rules and suppressions, issues with digest config, investigations with claim/read, channels, credentials, and rich query tools (logs, spans, metrics, SQL, traces, correlation). No obvious dead ends or missing core operations.

Resources