Search log streams with SQL across one or more OpenObserve instances. Automatically applies the most efficient query strategy based on time range: raw fetch for ≤1 h, sampling for 1–6 h, hourly aggregation for 6 h–7 d, daily aggregation beyond 7 d. SQL supports =, !=, >, <, >=, <=, IS NULL, IS NOT NULL, AND, OR, NOT, COUNT, SUM, AVG, MIN, MAX, GROUP BY, ORDER BY, histogram(_timestamp). String values use single quotes; stream names use double quotes. match_all('text') performs full-text search across indexed fields with wildcard support (). Do not add WHERE _timestamp filters — time range is handled by startTime and endTime parameters. Examples: SELECT * FROM "mystream" WHERE match_all('error') | SELECT code, COUNT(*) FROM "mystream" GROUP BY code

Execute multiple SQL log queries in parallel across OpenObserve instances and return all results together. Each query specifies its own instance, SQL, and time range. Useful for comparing data across instances or fetching related signals in a single round trip.

List the configured OpenObserve instances available to this server. Returns each instance's ID, name, URL, capabilities (logs, traces, metrics), and tags. Optionally filter by one or more tags or by a specific capability.

List all log streams available on one or more OpenObserve instances. Returns stream names, types, storage type, and document/storage statistics.

Return the field names and data types for one or more log streams on an OpenObserve instance. Accepts a single stream name or an array; schemas are fetched in parallel. Results are cached for 10 minutes.

Fetch log records immediately before and after a specific timestamp in a stream. Returns up to size records centered on the anchor timestamp. Useful for viewing the context surrounding a known event without writing a SQL query.