search
Unified search across your entire Costory workspace — dimension values, events, alerts, dashboards (with their conditionsCel), dashboard templates, reports, virtual dimensions, and budgets. PRIMARY tool for discovering CEL field names: each dimensions result includes dimension (the exact CEL/groupBy name, e.g. cos_sub_account_id), label, and topMatches. Use type: ["dimensions"] to focus on dimensions only. An empty query (query: "") with type: ["dimensions"] returns every dimension with its top values — use this when you need the full field catalog before building filterCel. Keys that are not imported yet are invisible here — use list_dimension_candidates for those. With a keyword, results are filtered to matching values (e.g. query: "prod" finds production values across dimensions). Use this when a user mentions a product, team, project, or service name and you need to discover where it appears in the cost data before querying. Returns matching dimension values, related events, alerts, dashboards, dashboardTemplates, reports, virtualDimensions, budgets. Virtual dimension hits include id, name, bqName (immutable query field — set at create, never changes), status, and description. Each dashboard result carries a "conditionsCel" string — the dashboard's CEL filter (empty when none) — so before calling update_dashboard you can decide whether to set "extendDashboardConditions: true" on your new widget. Budget results include id (parent budget id for URLs) and name/year; call get with the budget id to obtain the budgetVersionId needed for query. IMPORTANT: Use short, concise search terms — e.g. if the user says 'my kubernetes dashboard', just search for 'kubernetes', not the full phrase. Optional "type" array restricts results to specific entity buckets (dashboards, reports, alerts, budgets, dimensions, virtual_dimensions, events). FOLLOW-UP: After calling search, use get to fetch full details for dashboards, budgets, reports, virtual dimensions, and cost alerts by ID. For dimension values, use "query" to query data grouped by or filtered on the matched dimensions. When the user wants to add to a dashboard, use the id from the dashboards bucket as input to update_dashboard.
EXAMPLES:
• "List all CEL dimensions" → { query: "", type: ["dimensions"] }
• "Find account-related dimensions" → { query: "account", type: ["dimensions"] }
• "Show me kubernetes costs" → { query: "kubernetes" }
• "Find the data team dashboard" → { query: "data team" }
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End date for event search (YYYY-MM-DD). Defaults to today. | |
| from | No | Start date for event search (YYYY-MM-DD). Defaults to 90 days ago. | |
| slug | No | Organization slug. Omit to auto-detect from your account (fails if you belong to multiple orgs). | |
| type | No | Restrict results to these entity types. Omit for all. | |
| query | Yes | Search term (e.g. 'kubernetes', 'account'). Case-insensitive partial matching. Pass empty string with type: ['dimensions'] to list all CEL field names and top values. |