OpenObserve MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PROD_GCP_O2_TOKEN | Yes | Base64-encoded credentials for the production GCP OpenObserve instance (format: user@example.com:password encoded in base64) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_logsA | Search log streams with SQL across one or more OpenObserve instances. Automatically applies the most efficient query strategy based on time range: raw fetch for ≤1 h, sampling for 1–6 h, hourly aggregation for 6 h–7 d, daily aggregation beyond 7 d. SQL supports =, !=, >, <, >=, <=, IS NULL, IS NOT NULL, AND, OR, NOT, COUNT, SUM, AVG, MIN, MAX, GROUP BY, ORDER BY, histogram(_timestamp). String values use single quotes; stream names use double quotes. match_all('text') performs full-text search across indexed fields with wildcard support (). Do not add WHERE _timestamp filters — time range is handled by startTime and endTime parameters. Examples: SELECT * FROM "mystream" WHERE match_all('error') | SELECT code, COUNT(*) FROM "mystream" GROUP BY code |
| batch_queryA | Execute multiple SQL log queries in parallel across OpenObserve instances and return all results together. Each query specifies its own instance, SQL, and time range. Useful for comparing data across instances or fetching related signals in a single round trip. |
| list_instancesA | List the configured OpenObserve instances available to this server. Returns each instance's ID, name, URL, capabilities (logs, traces, metrics), and tags. Optionally filter by one or more tags or by a specific capability. |
| list_streamsA | List all log streams available on one or more OpenObserve instances. Returns stream names, types, storage type, and document/storage statistics. |
| get_stream_schemaA | Return the field names and data types for one or more log streams on an OpenObserve instance. Accepts a single stream name or an array; schemas are fetched in parallel. Results are cached for 10 minutes. |
| get_logs_aroundA | Fetch log records immediately before and after a specific timestamp in a stream. Returns up to size records centered on the anchor timestamp. Useful for viewing the context surrounding a known event without writing a SQL query. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 6 tools
Each tool has a clearly distinct purpose: listing instances, searching logs, batch queries, listing streams, fetching schema, and retrieving context around events. No two tools overlap in functionality.
All tool names follow a consistent verb_noun pattern (list_instances, search_logs, batch_query, list_streams, get_stream_schema, get_logs_around), with no mixing of conventions.
Six tools is well-scoped for interacting with OpenObserve instances, covering instance discovery, log searching (single and batch), stream listing, schema inspection, and context retrieval without being overwhelming or sparse.
The tool surface covers the core workflows of exploring and querying log data, but lacks direct support for querying metrics or traces, which are capabilities mentioned in instances. Still, for log-focused operations, it is nearly complete.