List all available Graylog connections configured in ~/.graylog-mcp/config.json

Connect to a specific Graylog instance by name. Must be called before fetching messages.

Fetch messages from the active Graylog connection. Use 'use_connection' first to select a connection.

Get messages surrounding a specific message. Provide messageId (preferred) or messageTimestamp to identify the target message.

List all available Graylog streams in the active connection.

List distinct values of a field with message counts. Useful for discovering available sources, environments, logger names, etc. Results are sorted by count descending.

Get a time-based histogram of log messages. Shows message counts over time intervals.

Aggregate log messages by field values with statistics. Get counts, sums, averages, etc. for field values.

Two-dimensional aggregation: field values over time. Shows how field values change over time intervals.

Debug helper to test if the histogram query finds any messages at all. Use this if histogram returns empty buckets.

Save a named search query for later reuse. Saves query parameters so you don't have to re-type complex searches.

List all saved searches.

Load and execute a saved search by name. Optional overrides can be provided to adjust the search at execution time.

Delete a saved search by name.

Search Graylog events and alerts. Use 'use_connection' first to select a connection.

Get Graylog event definitions. Use 'use_connection' first to select a connection.

Get Graylog event notifications. Use 'use_connection' first to select a connection.

Cluster similar log messages into Drain3-style templates. Fetches messages with the same args as fetch_graylog_messages, then groups them by structural similarity. Templates are persisted per connection and reused across calls.

List learned log templates for the active connection.

Delete a learned log template by ID.

Set or update a human-readable label for a template.

Export all learned templates for the active connection as JSON.

Import templates into the active connection's library.