Get Logs
ha_get_logsFetch Home Assistant logs from system, logbook, supervisor, or raw error files to diagnose errors, monitor entity changes, and triage issues with search, level filters, and pagination.
Instructions
Get Home Assistant logs from various sources.
Sources:
"logbook" (default): Entity state change history with pagination
"system": Structured system log entries (errors, warnings) via system_log/list
"error_log": Raw log text (home-assistant.log on container/pip installs; HA Core's journald stream on Supervisor-backed installs)
"supervisor": App (add-on) container logs (requires slug = app slug)
"system_service": HA-Supervisor-managed system service logs (requires slug ∈ {supervisor, host, core, dns, audio, cli, multicast, observer})
"logger": Effective log level per integration via logger/log_info (confirms logger.set_level changes took effect)
Prefer source='system' for triage. It returns HA's own deduplicated system_log entries with counts, first_occurred and full tracebacks; of those only the tracebacks are unrecoverable from the structured error_log summary — they are present in the raw text, so structured=False gets them back. Its counts also run since each error first occurred, while structured error_log counts only what is inside the fetched window (reported as window_start/window_end; every install now reads a capped window). Use error_log with structured=True for entries below system_log's WARNING+ ~50-entry cap, or for the per-component rollup.
Shared params: limit, search (keyword filter on entries/lines; matches integration domain for source='logger')
Order: order='newest' (default) returns most-recent first; order='oldest' returns chronological-first. Applies to all time-ordered sources (logbook, system, error_log, supervisor, system_service); ignored for source='logger' and for error_log with structured=True. For raw-text sources (error_log, supervisor, system_service) it sets the read direction of the most-recent window.
Logbook params: hours_back, entity_id, end_time, compact (default True — strips attribute dicts to save context)
Pagination (logbook + error_log): offset pages deeper; ignored for the
other sources. Logbook responses carry has_more plus a
pagination_hint. On error_log, offset counts raw log lines back from
the newest entry (journald entries on Supervisor-backed installs),
both modes read a bounded window per call — so level/search
filter and limit slice within that window only, and window_lines
reports the size actually requested — and the response carries
has_more with a next_offset to pass back while it stays true.
System/error_log params: level (ERROR, WARNING, INFO, DEBUG, CRITICAL)
error_log params: structured, top_n. In structured mode search
matches the message and logger name only, whereas on the raw path it
matches the whole line; limit/order do not apply, issues are
ranked by count, then severity, then recency, and the summary covers
a fixed deep window rather than the caller's limit.
Supervisor params: slug = app slug, e.g. "core_mosquitto" (use
ha_get_app() to list installed slugs)
System-service params: slug = service name. The slug "supervisor"
here means the Supervisor service's own logs, NOT an app with
that name — the source param disambiguates.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | ||
| level | No | ||
| limit | No | ||
| order | No | Sort order for time-ordered sources (logbook, system, error_log, supervisor, system_service): 'newest' (default) returns most-recent first; 'oldest' returns chronological-first. Ignored for source='logger', and for source='error_log' with structured=True (that summary is ranked by occurrence count, not by time). | newest |
| top_n | No | Max distinct issues to return when structured=True (default 20, capped at 500). Bounds the response regardless of log size. | |
| offset | No | Page deeper into source='logbook' and source='error_log' (ignored for other sources). On error_log it counts raw log lines back from the newest entry; pass the response's 'next_offset' to continue while 'has_more' is true. | |
| search | No | ||
| source | No | logbook | |
| compact | No | ||
| end_time | No | ||
| entity_id | No | ||
| hours_back | No | ||
| structured | No | source='error_log' only. When True, return a deduplicated, component-grouped summary of the log (counted issues sorted by frequency) instead of raw text. Use this on busy instances where the raw log is large enough to exhaust context. Ignored for other sources. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||