delimit_obs_logs
Search application and system logs across configured sources using a query string and time window to find matching log lines for incident investigation.
Instructions
Search application and system logs across configured sources (Pro).
When to use: during incident investigation when you have a symptom (error string, trace id, user id, request id) and need to find every log line mentioning it across the configured sources over a time window. The typical pattern is: delimit_obs_metrics flags a numeric anomaly, then this tool finds the offending log lines. When NOT to use: for numeric series (use delimit_obs_metrics), for the at-a-glance health rollup (delimit_obs_status), or to configure ongoing alerts (delimit_obs_alerts). Also: do not use this as a tail-follow surface — it is a windowed search, not a streaming subscription.
Sibling contrast: delimit_obs_metrics returns numeric series for the same backend; this returns text matches. Compared to grepping the local filesystem, this queries the centralised log store across services / hosts.
Side effects: read-only on the log backend and gated by require_premium — unlicensed callers receive a license payload and no query runs. On a licensed call, invokes backends.tools_infra.obs_logs which queries the backing log store; no data is written, no ledger entry, no notification. The response is routed through _with_next_steps.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search string (backend-specific syntax). Required. | |
| time_range | No | Window like "1h", "24h", "7d". Default "1h". | 1h |
| source | No | Optional log source override. Default None. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||