cluster_log_messages
Clusters similar log messages into structural templates, revealing recurring patterns and reducing log noise.
Instructions
Cluster similar log messages into Drain3-style templates. Fetches messages with the same args as fetch_graylog_messages, then groups them by structural similarity. Templates are persisted per connection and reused across calls.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Absolute end time (ISO) | |
| from | No | Absolute start time (ISO) | |
| field | No | Field to cluster on. Default 'message'. | |
| query | No | Query string (same as fetch_graylog_messages) | |
| filters | No | Field filters | |
| readOnly | No | If true, do not update template library. Default false. | |
| algorithm | No | Clustering algorithm. Default 'drain3'. | |
| streamIds | No | Optional stream IDs | |
| timeRange | No | Time range (e.g. '1h', '30m') | |
| exactMatch | No | Wrap query in quotes (default true) | |
| sampleSize | No | Max messages to fetch & cluster. Default 1000, max 10000. | |
| maxChildren | No | Max templates per length bucket (LRU evict beyond this). Default 100. | |
| includeSamples | No | Sample messages per cluster (first/middle/last by time). Default 3. | |
| minClusterSize | No | Singletons collapsed under '_misc' cluster. Default 2. | |
| similarityThreshold | No | Drain3 similarity threshold 0-1. Default 0.6. Lower = more aggressive merging. |