Skip to main content
Glama

Query Logs

logs
Read-onlyIdempotent

Find logs matching filter criteria within a time range.

Use this as your default starting point for log queries. Returns logs sorted by (timestamp, logId) descending (newest first). When investigating an error or a failure, call list_issues first: Fixter has often grouped it already into an issue with its count, first and last seen and a traceId to search from.

Returns the log's main fields by default; pass verbose=true to include its attributes (http/url/… flattened in, plus a resource object). Long string values are capped (maxStringChars). For raw columns or custom selection use run_sql. For one row with every attribute, use get_log; a cut value's marker carries the "more" call that reads the rest.

Defaults: from: 1 hour before to (or before now) when omitted; set it to read further back to: now when omitted limit: 100 (max 1000) service/level: any

Common patterns:

  • Errors in the last hour: level="ERROR", from=<1h ago>

  • Logs for a trace: traceId="abc123..."

  • Whole-token search (case-insensitive): messageContains="timeout"

  • Substring or regex search: not supported here; use run_sql

Returns: logs: array of log objects (lean unless verbose=true) nextCursor: opaque token (null on the last page); pass back as cursor to fetch the next page truncationHint: present when the page was cut to fit the response; nextCursor then reads on from the last log shown explorerUrl: shareable Fixter UI link opening this query in the log explorer — when the user asks to see or browse these logs, send them there rather than reproducing the listing; attach it when citing these logs as evidence (covers the service/level/traceId filters and the window; timestamps display in the viewer's browser timezone) queryStats: rowsReturned, elapsedMs

Input Schema

NameRequiredDescriptionDefault
toNoEnd of time window, ISO-8601 instant (exclusive); now when omitted
fromNoStart of time window, ISO-8601 instant (inclusive); 1 hour before to (or now) when omitted
levelNoFilter by log level: TRACE, DEBUG, INFO, WARN, ERROR
limitNoMax logs to return, default 100, max 1000
cursorNoOpaque cursor from a previous response's next_cursor
serviceNoFilter by service name (e.g. 'investigation-service')
traceIdNoFilter to a single trace id
verboseNoInclude the row's attributes (flattened in, plus a `resource` object). Long string values are still capped (maxStringChars) either way. Default false.
maxStringCharsNoMax characters of any string value (message or attribute) before truncation, at most 4000. Omit to use the server default.
messageContainsNoWhole-token match on the message, case-insensitive. 'time' does not match 'timeout'. A term containing separators requires each of its tokens to be present. For substring or regex matching use run_sql

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • changedInput schema / properties / from / description
      Previous value: -"Start of time window, ISO-8601 instant (inclusive)"New value: +"Start of time window, ISO-8601 instant (inclusive); 1 hour before to (or now) when omitted"
    • changedInput schema / properties / to / description
      Previous value: -"End of time window, ISO-8601 instant (exclusive)"New value: +"End of time window, ISO-8601 instant (exclusive); now when omitted"
  2. Changed1 schema field changed
    • changedInput schema / properties / maxStringChars / description
      Previous value: -"Max characters of any string value (message or attribute) before truncation. Omit to use the server default."New value: +"Max characters of any string value (message or attribute) before truncation, at most 4000. Omit to use the server default."
  3. Changed4 schema fields changed
    • addedInput schema / $schema
      Added value: +"https://json-schema.org/draft/2020-12/schema"
    • removedInput schema / additionalProperties
      Removed value: -false
    • addedInput schema / properties / limit / format
      Added value: +"int32"
    • addedInput schema / properties / maxStringChars / format
      Added value: +"int32"
  4. Added
  5. Removed
  6. Changed1 schema field changed
    • changedInput schema / properties / traceId / description
      Previous value: -"Filter to a single trace id (index-accelerated)"New value: +"Filter to a single trace id"
  7. Changed1 schema field changed
    • changedInput schema / properties / messageContains / description
      Previous value: -"Whole-word token to require in the message (index-accelerated via hasToken, case-sensitive whole words; for substring/regex use run_sql)"New value: +"Whole-token match on the message, case-insensitive. 'time' does not match 'timeout'. A term containing separators requires each of its tokens to be present. For substring or regex matching use run_sql"
  8. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already covering read-only/idempotent safety, the description adds substantial context beyond them: sort order (timestamp, logId descending), default window and limit with the 1000 ceiling, string truncation via maxStringChars and the 'more' marker, pagination via nextCursor including truncationHint behavior, and guidance to send users to explorerUrl rather than reproducing output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and routing, then organized into Defaults / Patterns / Returns sections that an agent can scan. It is long, and the verbose-attributes sentence partially duplicates the schema, but almost every line carries routing or return-shape information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description fully documents the return object (logs, nextCursor, truncationHint, explorerUrl, queryStats) and pagination semantics. Nothing material is left for the agent to infer before calling or continuing a page.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns extra by restating the effective defaults (from = 1h before, to = now, limit = 100) and by pairing parameters into usage patterns. Minor gap: it references 'verbose=true' and 'maxStringChars' but adds little about how maxStringChars interacts with the cut marker beyond what the schema says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Find logs matching filter criteria within a time range') and immediately positions itself as the default entry point for log queries. It distinguishes itself from siblings by naming list_issues, run_sql, and get_log with the conditions that select each.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing: call list_issues first when investigating an error, use run_sql for raw columns/substring/regex, use get_log for one row with every attribute. It also states the negative case ('Substring or regex search: not supported here') and gives concrete named patterns for error, trace, and token searches.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources