query_logs
Fetch recent log entries for a service with error/warning counts and recurring error patterns. Inspect service behavior or investigate anomalies detected by other tools.
Instructions
Fetch recent log entries for ONE service over a look-back window, with a pre-computed summary (error/warning counts and the most frequent error patterns). When to use: to inspect what a service actually logged, or to investigate an error spike surfaced by detect_anomalies / get_service_health. For numeric metrics use query_metrics instead. Prerequisites: get the exact service name from list_services (the service must expose a logs signal). Behavior: read-only, no side effects. Returns the matching log entries (newest first, capped by limit) plus a summary with total/error/warn counts and top recurring error patterns. No matches yields an empty result with a zeroed summary; an unreachable backend yields a structured explanatory error, never an exception.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| service | Yes | Required. Exact, case-sensitive service name exactly as returned by `list_services` (e.g. 'payment-service'). | |
| query | No | Optional. Filter expression matched against the log message; regular expressions are supported. Omit to return all entries in the window. | |
| duration | No | Optional. Look-back window ending at 'now', written as <number><unit> with unit s|m|h|d (e.g. '5m', '1h', '24h'). Default: '5m'. | |
| level | No | Optional. Return only entries at this severity. Default: all levels. | |
| limit | No | Optional. Maximum number of log entries to return (most recent first). Default: 100. | |
| bypass_redaction | No | Optional. When true, request that PII/secret redaction be skipped for this single call. The server only honours this when the calling credential was explicitly authorised via OMCP_KEY_BYPASS_REDACTION; otherwise the request still gets redacted output. Default: false. |