search
Read individual matching log lines across one or more Graylog streams, newest-first. Returns concise high-signal fields by default; set verbose for all fields.
Instructions
Read individual matching log lines across one or more streams, merged newest-first. Returns a concise projection of high-signal fields by default (set verbose:true for all fields). Raw lines are expensive: if you want to know WHAT is failing rather than read specific lines, use analyze first — a hundred repetitions of one error cost a hundred times as much here as one aggregated count. Pass streams:"*" to cover every readable stream when you do not know which stream a service logs to (the Default Stream often excludes it).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Absolute window end, ISO-8601 UTC. Requires `from`. | |
| from | No | Absolute window start, ISO-8601 UTC (e.g. "2026-07-11 14:00:00"). Requires `to`. Overrides the relative range. | |
| query | Yes | Lucene query, e.g. "level:ERROR", "error OR exception", "source:api-*". Use "*" for everything. | |
| fields | No | Comma-separated explicit field list to return. Overrides the concise projection. | |
| streams | Yes | Comma-separated Graylog stream IDs (from list_streams), or "*" for every stream the token can read. Required. Prefer "*" unless you already know the stream: the Default Stream ("000000000000000000000001") is NOT "everything" — most clusters route each service to its own stream that REMOVES its matches from the Default Stream, so searching only the Default Stream silently misses those services. | |
| verbose | No | Return every populated field (untruncated) instead of the concise projection. Default: false. | |
| instance | No | Graylog instance to query. Active: "instance_1". Default: "instance_1". | |
| messageChars | No | Max characters of the raw message body per hit. Default: 500. The parsed fields (msg, name, err) usually carry the summary already, so raise this only when the detail you need lives in the raw body. | |
| searchCountLimit | No | Max messages to return. Default: 50. | |
| searchTimeRangeInSeconds | No | Relative time range in seconds, ending now. Default: 900 (15 min). Ignored if from/to are set. |