Which integrations are available for this server?

Allows searching and analyzing Elasticsearch logs in ECS format, providing tools for error search, pattern detection, trend analysis, trace context, and error comparison.

How do I use es-error-lens?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@es-error-lens search errors in the last hour for checkout-api" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

es-error-lens

by TerraCo89

Overview Schema Source Related Servers Discussions Admin

Python

Remote

es-error-lens

License: MIT Python 3.10+ Offline tests

An MCP server that gives LLM agents eyes on your Elasticsearch logs. Point it at a cluster holding ECS-format logs and any MCP client (Claude Desktop, Claude Code, or your own agent) can search errors, detect recurring patterns, analyze error-rate trends, and pull full trace context — the queries an engineer runs by hand during triage, exposed as tools.

Tool	What it answers
`search_errors`	"What's failing right now?" — filtered by window, service, level
`get_error_patterns`	"Is this systemic or a one-off?" — message aggregation with occurrence counts
`analyze_error_trend`	"Is it getting worse?" — time-series histogram, peak detection, trend verdict
`get_error_context`	"What led up to this?" — every log sharing the error's trace ID, in order
`compare_errors`	"Are these two failures related?" — attribute + fuzzy-message comparison
`health_check`	"Can I even reach the cluster?"

Elasticsearch is spoken to over its plain REST API via httpx — no Elasticsearch client dependency, and the HTTP layer is transport-injectable, so the entire server runs offline against the bundled FakeElasticsearch for tests and the demo.

Demo (offline, no cluster, no API keys)

git clone https://github.com/TerraCo89/es-error-lens && cd es-error-lens
python -m venv .venv && source .venv/bin/activate   # .venv\Scripts\activate on Windows
pip install -e ".[dev]"

pytest              # 22 tests, all offline, < 1 second
es-error-lens-demo  # synthetic incident walk-through

The demo mounts FakeElasticsearch with a deterministic 60-document ECS corpus simulating a small incident — a steady payment-provider failure, an escalating search-timeout problem, and background noise — then triages it:

[get_error_patterns] 2 recurring patterns in 57 errors:
   42x  [TimeoutError] Search query timed out after 30s  (search-api)
   13x  [UpstreamHTTPError] Payment provider returned 502 Bad Gateway  (checkout-api)
  error types: TimeoutError=42, UpstreamHTTPError=13, TemplateError=1, ConnectionResetError=1

[analyze_error_trend] search-api: 42 errors, trend=INCREASING
  peak: 8 errors at 2026-07-10T06:00:00Z

[get_error_context] trace-checkout-7f3a -> [UpstreamHTTPError] Payment provider returned 502 Bad Gateway
  3 related logs on the same trace:
    info  POST /checkout started
    info  Cart validated: 3 items
    warn  Payment provider latency 4100ms exceeds SLO

Demo result: OK

Related MCP server: Kibana Log Analysis & API Dashboard MCP Server

Using it against a real cluster

export ELASTICSEARCH_URL=http://localhost:9200   # default
export ES_INDEX_PATTERN=logs-*                   # default

es-error-lens                                    # stdio, for Claude Desktop / Claude Code
es-error-lens --transport streamable-http --port 8080   # HTTP clients

Claude Desktop / Claude Code config:

{
  "mcpServers": {
    "es-error-lens": {
      "command": "es-error-lens",
      "env": { "ELASTICSEARCH_URL": "http://localhost:9200" }
    }
  }
}

Expected document shape — standard ECS fields, the ones Filebeat and the ECS logging libraries emit by default: @timestamp, log.level, message, service.name, error.type, error.stack_trace, trace.id, host.name. Anything missing degrades gracefully (fields come back null).

Testing without a cluster

FakeElasticsearch (also exported) implements just enough of the _search API for this server: bool queries with term/range clauses, sorting, terms aggregations with top_hits sub-aggregations, and date_histogram with fixed intervals. Mount it in your own tests:

from es_error_lens import FakeElasticsearch, set_transport, search_errors

set_transport(FakeElasticsearch(my_ecs_docs).transport())
result = await search_errors(time_range="1h", service="checkout-api")

The test suite runs entirely through it — deterministic, offline, fast — and a hygiene test enforces that all bundled demo data stays synthetic (hosts under .example, no real domains or addresses).

Provenance

Extracted from a personal observability platform where it fronts the Elasticsearch instance that aggregates structured logs from a fleet of side-project services, letting coding agents triage production errors during development sessions. All demo and test data in this repository is synthetic.

License

Available Tools

6 tools

analyze_error_trendA

Analyze error rate trends over time for a service.

Builds a time-series histogram of error counts to identify spikes, patterns, and direction of travel.

ParametersJSON Schema

Name	Required	Description	Default
`service`	Yes	Service name to analyze (e.g., "checkout-api")
`interval`	No	Histogram bucket interval ("1m", "5m", "15m", "1h", "1d")	1h
`time_range`	No	Time range to analyze (e.g., "24h", "7d", "30d")	24h

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A3.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It mentions building a time-series histogram but omits crucial details such as permissions needed, rate limits, or whether the tool is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, no redundant wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and the presence of an output schema, the description provides sufficient context about the purpose and output type, though it could briefly mention how results are interpreted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the baseline is 3. The description adds 'histogram' context, but does not elaborate on output semantics beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it analyzes error rate trends over time for a service, using a verb and specific resource. It distinguishes itself from sibling tools like compare_errors or get_error_context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for trend analysis but does not provide explicit guidance on when to use this tool vs alternatives, nor does it mention when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_errorsA

Compare two errors to find similarities and differences.

Useful for judging whether two failures are related or share a root cause.

ParametersJSON Schema

Name	Required	Description	Default
`trace_id_1`	Yes	First error's trace ID
`trace_id_2`	Yes	Second error's trace ID

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states the tool compares errors but does not disclose whether it is read-only, destructive, or has side effects. It implies analysis but lacks explicit behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two efficient sentences, front-loading the core purpose and adding a usage hint. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple two-parameter tool with a full input schema and an output schema (though not shown), the description is adequate. It could mention its read-only nature given no annotations, but overall it is complete enough for agent selection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters have descriptions in the schema (trace_id_1 and trace_id_2). The description adds no additional meaning beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Compare' and the resource 'two errors', specifying the action exactly. It mentions finding similarities and differences, which differentiates it from sibling tools like analyze_error_trend or get_error_context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear use case: 'judging whether two failures are related or share a root cause.' It does not explicitly state when not to use this tool or name alternatives, but the context is sufficient for the sister tools context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_error_contextA

Get full context for an error using its trace ID (correlation ID).

Retrieves the error and all related logs sharing the same trace ID, providing complete request context for debugging.

ParametersJSON Schema

Name	Required	Description	Default
`trace_id`	Yes	The trace/correlation ID to search for
`include_related`	No	Also return non-error logs with the same trace ID

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden but only states what it retrieves. It does not disclose side effects, auth needs, rate limits, or that it is read-only, which is acceptable for a retrieval tool but lacks explicit behavioral constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no unnecessary words. Front-loaded purpose and clear explanation of what is retrieved. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 2 well-documented parameters and an output schema, the description provides sufficient context for an agent to understand and invoke the tool correctly. It could mention read-only nature or prerequisite that trace_id exists, but overall it is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context by explaining that trace_id is used to fetch error and related logs, aligning with include_related. However, it doesn't explicitly describe include_related beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves full context for an error using a trace ID, specifying it gets the error and related logs. This distinguishes it from siblings like search_errors or analyze_error_trend, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use the tool (when you have a trace ID and need debugging context) but does not explicitly list when not to use it or mention alternative tools, though the sibling names imply alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_error_patternsA

Detect recurring error patterns by aggregating similar error messages.

Groups errors by message and identifies the most common patterns — useful for separating systemic issues from one-off errors.

ParametersJSON Schema

Name	Required	Description	Default
`service`	No	Service name to filter by (optional)
`time_range`	No	Time range to analyze (e.g., "15m", "1h", "24h", "7d")	24h
`max_patterns`	No	Maximum number of patterns to return
`min_occurrences`	No	Minimum occurrences to be considered a pattern

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It mentions grouping by message and identifying common patterns, which is a basic behavioral overview. Missing details like read-only hint, permission requirements, or performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no redundancy. Each sentence adds value: first states what it does, second explains the grouping logic and use case. Front-loaded with verb and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given output schema exists to describe return values, description adequately covers purpose and usage context. Missing explicit mention of grouping criterion (message) but it's implied. Siblings provide enough differentiation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% description coverage, so baseline is 3. Description adds context that patterns are grouped by message and systemic issues are targeted, but does not elaborate on parameter syntax or constraints beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'Detect' and resource 'recurring error patterns' with method 'aggregating similar error messages'. It distinguishes from siblings like 'search_errors' (find specific errors) and 'analyze_error_trend' (trend analysis) by focusing on pattern detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states use case: 'useful for separating systemic issues from one-off errors'. This provides clear context but does not mention when not to use or compare directly with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

health_checkA

Check Elasticsearch connection health.

Returns: Dictionary with: - status: "healthy" or "unhealthy" - elasticsearch_url: Configured Elasticsearch URL - cluster_info: Cluster name/version (when healthy)

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4.1/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the return structure (status, url, cluster_info) which provides some behavioral insight. However, it does not explicitly state that the operation is read-only or non-destructive, and no annotations are provided to fill this gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly concise with two sentences. It starts with the main action and follows with a bullet-like list of return fields. Every word adds value, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no annotations, and output schema present), the description is complete. It clearly states the return format, which is sufficient for an agent to understand the tool's behavior and output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters (input schema empty, coverage 100%). According to rubric, 0 parameters yields a baseline of 4. The description does not add parameter information, but none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check Elasticsearch connection health.' This is a specific verb+resource combination that distinguishes it from sibling tools which focus on error analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidelines on when to use this tool versus alternatives. While the purpose implies it is for verifying connectivity, the description lacks context such as prerequisites or scenarios where it is particularly useful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_errorsC

Search for errors in Elasticsearch logs.

ParametersJSON Schema

Name	Required	Description	Default
`service`	No	Service name to filter by (e.g., "checkout-api")
`log_level`	No	Log level to filter by ("error", "warn", "info", "debug", "all")	error
`time_range`	No	Time range to search (e.g., "15m", "1h", "24h", "7d")	1h
`max_results`	No	Maximum number of results to return (default: 100)

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral traits such as permissions, side effects (e.g., read-only nature), or any constraints like rate limits. Since annotations are absent, the description carries the full burden but fails to address these aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that efficiently conveys the primary function. While it could be slightly more informative, it contains no wasted words and is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fails to explain the output format or any post-processing expectations, despite the presence of an output schema. It also does not mention how results are ordered or paginated. Given the parameter count of 4 and the need for search result details, the description is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides full coverage (100%) with descriptions for all 4 parameters. The tool description adds no additional meaning beyond what the schema already states, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action and resource ('Search for errors in Elasticsearch logs'), providing a specific verb and resource. However, it does not differentiate from sibling tools like 'get_error_patterns' or 'analyze_error_trend', which could lead to confusion about which tool to use for specific error-related tasks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description lacks context for selecting this tool over siblings such as 'analyze_error_trend' or 'get_error_context', leaving the agent without decision-making support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

6 tool updatesv0.1.0Jul 10, 2026
- First observedanalyze_error_trend
- First observedcompare_errors
- First observedget_error_context
- First observedget_error_patterns
- First observedhealth_check
- First observedsearch_errors

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.8/5.0

Scored 2026-07-10 08:30 across 6 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: trend analysis, comparison, context retrieval, pattern detection, health check, and search. No overlapping functionality.

Naming Consistency4/5

Five tools follow verb_noun pattern (e.g., analyze_error_trend, search_errors); health_check is noun_verb, a minor deviation. Otherwise consistent snake_case.

Tool Count5/5

Six tools is well-scoped for an error analysis server. Each tool contributes a distinct capability without bloat.

Completeness5/5

Covers error search, trend analysis, pattern detection, context retrieval, comparison, and health check. No obvious gaps for the observation/analysis domain.

Maintenance

ActivityStale

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

Foam Observability
io.github.foam-ai
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Observability Monitoring Developer Tools
2
SpanlyOAuth
com.spanly
MCP observability. Query live traffic, errors, duration, and alerts from your AI agent.
Observability Monitoring
3
SuperlogOAuth
sh.superlog
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
Monitoring Observability
21,039
llm-orchestration-agent-2
ai.getvda
MCP-Native LLM Orchestration Agent
Agent Orchestration AI & Machine Learning
1

Related MCP Servers

CloudWatch Log Analyst MCP
Monitoring Observability Cloud Platforms
eugeneoh04
A
license
Not graded
quality
D
maintenance
Enables LLMs to autonomously query AWS CloudWatch Logs and perform structured root-cause analysis via natural language prompts, using MCP tools for log group listing and Insights queries.
Updated 4 months ago (2026-05-12 01:23 UTC)
MIT
Kibana Log Analysis & API
Monitoring Observability Developer Tools
sid-s-s
A
license
A
quality
D
maintenance
Enables AI assistants to search Elasticsearch logs, retrieve log details, analyze service health, scan local codebases for APIs, and create Kibana dashboards.
Updated 6 months ago (2026-03-24 04:55 UTC)
5
10 npm
MIT
elasticsearch-logs
Observability Databases
ws135y
F
license
Not graded
quality
C
maintenance
Read-only MCP server for Elasticsearch log querying. Enables natural language search, filtering, context retrieval, and aggregation of logs.
Updated a month ago (2026-08-04 06:52 UTC)
-
graylog-mcp
Observability Monitoring
Kinet-s-r-o
F
license
Not graded
quality
B
maintenance
Enables AI agents to query and analyze Graylog logs through MCP tools for search, aggregation, stream listing, and saved queries, with optional OpenAI-powered natural language orchestration and audit logging.
Updated 7 days ago (2026-09-07 14:07 UTC)
-