search_logs

Instructions

Implementation Reference

• src/index.ts:170-251 (handler)

  The main handler function for the search_logs tool. Creates a Sumo Logic search job, polls until results are gathered (up to 60s), fetches messages, and returns trimmed log entries. Cleans up the job via DELETE on completion.

  async function searchLogs(
    config: Config,
    input: SearchInput,
  ): Promise<TrimmedMessage[]> {
    const max = Math.min(input.max_results ?? 100, MAX_RESULTS_LIMIT);
    const jobBody = {
      query: input.query,
      from: input.from ?? '-15m',
      to: input.to ?? 'now',
      timeZone: input.timezone ?? 'UTC',
    };
  
    const create = await sumoFetchWithRetry(
      config,
      'POST',
      '/api/v1/search/jobs',
      jobBody,
    );
    if (create.status >= 400) throw mapError(create.status, create.body);
  
    const createBody = create.body as { id?: string } | null;
    const jobId = createBody?.id;
    if (!jobId) {
      throw new SumoError(
        `Sumo did not return a job id. Response: ${JSON.stringify(create.body)}`,
      );
    }
  
    try {
      const start = Date.now();
      while (true) {
        if (Date.now() - start > MAX_SEARCH_DURATION_MS) {
          throw new SumoError(
            'Search did not complete within 60s. Try a smaller time range or simpler query.',
          );
        }
        const status = await sumoFetchWithRetry(
          config,
          'GET',
          `/api/v1/search/jobs/${jobId}`,
        );
        if (status.status >= 400) throw mapError(status.status, status.body);
  
        const statusBody = status.body as { state?: string } | null;
        if (statusBody?.state === 'DONE GATHERING RESULTS') break;
        if (statusBody?.state === 'CANCELLED') {
          throw new SumoError('Search job was cancelled by Sumo.');
        }
  
        const elapsed = Date.now() - start;
        const pollIntervalMs = elapsed < 10_000 ? 1000 : 5000;
        await sleep(pollIntervalMs);
      }
  
      const results = await sumoFetchWithRetry(
        config,
        'GET',
        `/api/v1/search/jobs/${jobId}/messages?offset=0&limit=${max}`,
      );
      if (results.status >= 400) throw mapError(results.status, results.body);
  
      const resultsBody = results.body as { messages?: unknown[] } | null;
      const rawMessages = resultsBody?.messages ?? [];
      return rawMessages.map((msg) => {
        const wrapper = msg as { map?: Record<string, string> } | null;
        const map = wrapper?.map ?? (msg as Record<string, string>) ?? {};
        return {
          _messageTime: map._messageTime ?? '',
          _sourceCategory: map._sourceCategory,
          _sourceHost: map._sourceHost,
          _sourceName: map._sourceName,
          _raw: map._raw ?? '',
        };
      });
    } finally {
      try {
        await sumoFetch(config, 'DELETE', `/api/v1/search/jobs/${jobId}`);
      } catch {
        // best-effort cleanup; intentionally swallowed
      }
    }
  }

• src/index.ts:154-160 (schema)

  Input interface for the search_logs tool: query, from/to time range, max_results, timezone.

  interface SearchInput {
    query: string;
    from?: string;
    to?: string;
    max_results?: number;
    timezone?: string;
  }

• src/index.ts:162-168 (schema)

  Output interface for search_logs: trimmed message fields (_messageTime, _sourceCategory, _sourceHost, _sourceName, _raw).

  interface TrimmedMessage {
    _messageTime: string;
    _sourceCategory?: string;
    _sourceHost?: string;
    _sourceName?: string;
    _raw: string;
  }

• src/index.ts:260-307 (registration)

  Registers the search_logs tool with the MCP server using server.tool(), including Zod schema definitions for input validation and the async handler that calls searchLogs().

  server.tool(
    'search_logs',
    'Run a Sumo Logic search and return matching log lines. Use this to investigate production issues, find errors, trace events, or look up activity in logs. Returns trimmed messages with timestamp, source category, host, source name, and raw log line.',
    {
      query: z.string().describe('Sumo Logic search expression (e.g. `_sourceCategory=prod/api error`).'),
      from: z
        .string()
        .optional()
        .describe('Start time. ISO 8601 (e.g. "2026-05-07T10:00:00") or Sumo relative ("-15m", "-1h", "-1d", "now"). Default "-15m".'),
      to: z
        .string()
        .optional()
        .describe('End time. Same format as `from`. Default "now".'),
      max_results: z
        .number()
        .int()
        .positive()
        .max(MAX_RESULTS_LIMIT)
        .optional()
        .describe(`Max messages to return. Default 100, capped at ${MAX_RESULTS_LIMIT}.`),
      timezone: z
        .string()
        .optional()
        .describe('IANA timezone name for the search (e.g. "UTC", "Europe/London"). Default "UTC".'),
    },
    async (args) => {
      try {
        const messages = await searchLogs(config, args);
        return {
          content: [
            {
              type: 'text',
              text: JSON.stringify(messages, null, 2),
            },
          ],
        };
      } catch (err) {
        const message =
          err instanceof SumoError
            ? err.userMessage
            : `Unexpected error: ${err instanceof Error ? err.message : String(err)}`;
        return {
          isError: true,
          content: [{ type: 'text', text: message }],
        };
      }
    },
  );

• src/index.ts:111-128 (helper)

  Helper function sumoFetchWithRetry used by searchLogs to make HTTP requests with rate-limit retry logic.

  async function sumoFetchWithRetry(
    config: Config,
    method: string,
    path: string,
    body?: unknown,
  ): Promise<SumoResponse> {
    let attempt = 0;
    while (true) {
      const result = await sumoFetch(config, method, path, body);
      if (result.status !== 429) return result;
      if (attempt >= RATE_LIMIT_RETRIES) {
        throw new SumoError('Rate limited by Sumo.');
      }
      const backoffMs = 1000 * Math.pow(2, attempt);
      await sleep(backoffMs);
      attempt++;
    }
  }