find_error_pattern_logs
Search Loki logs to identify elevated error patterns within specified time ranges and label scopes for monitoring analysis.
Instructions
Searches Loki logs for elevated error patterns and returns the results
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End time for the investigation | |
| labels | Yes | Labels to scope the analysis | |
| name | Yes | The name of the investigation | |
| start | No | Start time for the investigation |
Implementation Reference
- src/tools/sift.ts:175-212 (handler)The main handler function that creates a Sift investigation of type 'error_patterns' to find elevated error patterns in Loki logs.handler: async (params, context: ToolContext) => { try { const client = createSiftClient(context.config.grafanaConfig); // Create investigation const investigationData = { name: params.name, start: params.start || new Date(Date.now() - 30 * 60 * 1000).toISOString(), end: params.end || new Date().toISOString(), labels: params.labels, analyses: [ { type: 'error_patterns', parameters: { labels: params.labels, }, }, ], }; const response = await client.post('/api/v1/investigations', investigationData); const investigationId = response.data.id; // Poll for results (simplified - real implementation would need proper polling) await new Promise(resolve => setTimeout(resolve, 5000)); const resultResponse = await client.get(`/api/v1/investigations/${investigationId}`); return createToolResult({ investigationId, status: resultResponse.data.status, analyses: resultResponse.data.analyses, message: 'Investigation started. Check status for results.', }); } catch (error: any) { return createErrorResult(error.response?.data?.message || error.message); } },
- src/tools/sift.ts:26-31 (schema)Zod input schema defining parameters: name, labels, optional start and end times.const FindErrorPatternLogsSchema = z.object({ name: z.string().describe('The name of the investigation'), labels: z.record(z.string()).describe('Labels to scope the analysis'), start: z.string().optional().describe('Start time for the investigation'), end: z.string().optional().describe('End time for the investigation'), });
- src/tools/sift.ts:220-220 (registration)Registers the findErrorPatternLogs tool within the registerSiftTools function.server.registerTool(findErrorPatternLogs);
- src/cli.ts:126-126 (registration)Invokes registerSiftTools (which registers find_error_pattern_logs) if 'sift' tool category is enabled.registerSiftTools(server);
- src/tools/sift.ts:34-57 (helper)Helper function to create Axios client for Sift API calls, used by the handler.function createSiftClient(config: any) { const headers: any = { 'User-Agent': 'mcp-grafana/1.0.0', 'Content-Type': 'application/json', }; if (config.serviceAccountToken) { headers['Authorization'] = `Bearer ${config.serviceAccountToken}`; } else if (config.apiKey) { headers['Authorization'] = `Bearer ${config.apiKey}`; } // Sift uses a different base URL pattern const baseUrl = config.url.replace(/\/$/, ''); const siftUrl = baseUrl.includes('grafana.net') ? baseUrl.replace('grafana.net', 'sift.grafana.net') : `${baseUrl}/api/plugins/grafana-sift-app/resources`; return axios.create({ baseURL: siftUrl, headers, timeout: 60000, // Longer timeout for investigations }); }