logs
Find logs matching filter criteria within a time range.
Use this as your default starting point for log queries. Returns logs sorted by (timestamp, logId) descending (newest first).
Returns the log's main fields by default; pass verbose=true to include its
attributes (http/url/… flattened in, plus a resource object). Long string values
are capped (maxStringChars). For raw columns or custom selection use run_sql. For
the full untruncated body of one row, use get_log.
Defaults: from/to: open window if omitted — beware of unbounded scans limit: 100 (max 1000) service/level: any
Common patterns:
Errors in the last hour: level="ERROR", from=<1h ago>
Logs for a trace: traceId="abc123..."
Whole-token search (case-insensitive): messageContains="timeout"
Substring or regex search: not supported here; use run_sql
Returns: logs: array of log objects (lean unless verbose=true) nextCursor: opaque token (null on the last page); pass back as cursor to fetch the next page explorerUrl: shareable Fixter UI link opening this query in the log explorer — attach it when citing these logs as evidence to the user (covers the service/level/traceId filters and the window; timestamps display in the viewer's browser timezone) queryStats: rowsReturned, elapsedMs
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of time window, ISO-8601 instant (exclusive) | |
| from | No | Start of time window, ISO-8601 instant (inclusive) | |
| level | No | Filter by log level: TRACE, DEBUG, INFO, WARN, ERROR | |
| limit | No | Max logs to return, default 100, max 1000 | |
| cursor | No | Opaque cursor from a previous response's next_cursor | |
| service | No | Filter by service name (e.g. 'investigation-service') | |
| traceId | No | Filter to a single trace id | |
| verbose | No | Include the row's attributes (flattened in, plus a `resource` object). Long string values are still capped (maxStringChars) either way. Default false. | |
| maxStringChars | No | Max characters of any string value (message or attribute) before truncation. Omit to use the server default. | |
| messageContains | No | Whole-token match on the message, case-insensitive. 'time' does not match 'timeout'. A term containing separators requires each of its tokens to be present. For substring or regex matching use run_sql |