Skip to main content
Glama
jrvalinas

elastic-mcp

by jrvalinas

MCP Elasticsearch Logs

Servidor MCP pequeno y orientado a produccion para diagnosticar incidencias desde logs en Elasticsearch con esquema desconocido.

Que hace

  • Conexion a Elasticsearch con cliente async oficial.

  • Descubrimiento dinamico de schema con _field_caps + validacion opcional con documento reciente.

  • Tools MCP enfocadas en diagnostico de logs.

  • Respuesta normalizada (no devuelve hits crudos como salida principal).

Related MCP server: Elastic MCP Server

Tools soportadas

  • ping

  • discover_log_schema

  • get_latest_logs

  • get_logs_for_service

  • get_logs_by_correlation_id

  • diagnose_issue

Referencia detallada de cada tool en tools.md.

Variables de entorno

  • ELASTICSEARCH_URL (requerida)

  • ELASTICSEARCH_API_KEY (opcional, preferida si el cluster usa auth)

  • ELASTICSEARCH_USERNAME (opcional)

  • ELASTICSEARCH_PASSWORD (opcional)

  • ELASTICSEARCH_INDEX_PATTERN (default: logs-*)

  • ELASTICSEARCH_VERIFY_CERTS (default: true)

  • ELASTICSEARCH_CA_CERTS (opcional)

Reglas de autenticacion:

  1. Si existe ELASTICSEARCH_API_KEY, se usa esa.

  2. Si no, y existen ELASTICSEARCH_USERNAME + ELASTICSEARCH_PASSWORD, se usa basic auth.

  3. Si no hay credenciales, el cliente conecta sin autenticacion.

Como funciona el schema discovery

  1. Consulta _field_caps sobre el index pattern configurado.

  2. Detecta campos candidatos para timestamp, message, level, service y correlation.

  3. Aplica listas ordenadas de prioridad.

  4. Si hay sample document, prioriza campos realmente poblados.

  5. Devuelve schema parcial (null en lo no encontrado).

Filtro temporal

Se soporta:

  • last relativo (15m, 1h, 24h, 7d)

  • start/end explicitos (ISO datetime)

Reglas:

  • last no se puede combinar con start/end.

  • formatos invalidos se rechazan.

  • start > end se rechaza.

Ejecucion local

python3.14 -m venv .venv
source .venv/bin/activate
pip install --upgrade pip
pip install -e ".[dev]"

Configura entorno (ejemplo):

cp .env.example .env

Arranque en stdio (default):

mcp-elastic-logs

Arranque en red (streamable-http):

python -m mcp_elastic_logs.server --transport streamable-http --host 0.0.0.0 --port 8093

Ejecucion con Docker

  1. Preparar variables:

cp .env.example .env
  1. Build de imagen:

docker build -t mcp-elastic-logs:latest .
  1. Ejecutar contenedor:

docker run --rm -p 8093:8093 --env-file .env mcp-elastic-logs:latest

Ejecucion con Docker Compose

docker compose up --build

El servicio queda escuchando en http://localhost:8093 con transporte streamable-http.

Entorno de test (Elastic + Kibana + Logstash + MCP)

Tambien tienes un stack de test completo en docker-compose.test.yml, basado en tu plantilla, con un servicio extra seed-logs que carga documentos de ejemplo en logs-test-000001 para poder probar tools inmediatamente.

Arranque:

docker compose -f docker-compose.test.yml up --build

Servicios disponibles:

  • Elasticsearch: http://localhost:9200

  • Kibana: http://localhost:5601

  • MCP server: http://localhost:8093

Nota: este stack de test usa Elasticsearch con seguridad deshabilitada (xpack.security.enabled=false). El MCP puede conectar sin credenciales en ese escenario, asi que el compose de test no necesita valores dummy.

Configuracion de cliente MCP (ejemplo)

{
  "mcpServers": {
    "elastic-logs": {
      "command": "mcp-elastic-logs",
      "env": {
        "ELASTICSEARCH_URL": "https://localhost:9200",
        "ELASTICSEARCH_API_KEY": "<your-api-key>",
        "ELASTICSEARCH_INDEX_PATTERN": "logs-*",
        "ELASTICSEARCH_VERIFY_CERTS": "false"
      }
    }
  }
}

Documentacion auxiliar

  • tools.md: detalle de tools, parametros y comportamiento.

  • Agents.md: objetivo del proyecto, stack usado y guia de lectura.

Available Tools

6 tools
diagnose_issueDiagnose IssueC

Convenience diagnosis tool combining search + small summary. Use exclude_messages to filter out logs matching wildcard patterns (e.g. ["/health", "heartbeat"]).

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
lastNo1h
levelNo
limitNo
startNo
serviceNo
correlation_idNo
exclude_messagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of explaining behavior. It mentions 'combining search + small summary' and filtering with exclude_messages, but does not clarify whether the tool only reads logs, aggregates across services, or has any side effects or rate limits. The behavior remains partly opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two short sentences, and clearly mentions an example for exclude_messages. It is well-structured enough to be quickly read, though the brevity contributes to vagueness in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters and an output schema, the description provides insufficient context. It does not explain what should be passed for the time filters, how the summary is generated, or what the output format looks like (despite an output schema existing). The tool's role in a diagnosis workflow is not fully contextualized.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero description coverage for parameters, and the description only explains the exclude_messages parameter. The other seven parameters (start, end, last, level, limit, service, correlation_id) are not described at all, leaving the agent without guidance on their meaning or usage. This is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it is a 'Convenience diagnosis tool combining search + small summary', which gives a general sense of purpose but lacks specificity about what is searched, what the summary contains, or how it differs from other log-related tools. The verb 'diagnose' is implied but not explicitly stated as an action on an issue, making it somewhat vague.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus the sibling tools like get_logs_for_service or get_logs_by_correlation_id. The word 'convenience' hints at being a wrapper, but it does not state conditions for use or mention alternatives, leaving the agent to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

discover_log_schemaDiscover Log SchemaA

Discover likely timestamp/message/service/level/correlation fields.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It mentions only the discovery action and does not disclose side effects, output format, or any operational limitations such as rate limits or access requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that directly states the tool's purpose without unnecessary words or extraneous detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool, the description adequately conveys what it does. It could mention that the output is a schema or set of field names, but that is reasonably implied by the tool's name and description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is effectively 100%. According to the rubric, a baseline of 4 applies when there are no parameters, and there is no need for parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: discovering likely timestamp, message, service, level, and correlation fields. It is specific and distinguishes this tool from the sibling log-retrieval tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given on when to use this tool versus the sibling tools. It is implied that this is a preliminary schema-discovery step, but the description does not state that or mention any alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_latest_logsGet Latest LogsB

Fetch latest logs, optionally filtered by service and level. Use exclude_messages to filter out logs matching wildcard patterns (e.g. ["/health", "heartbeat"]).

ParametersJSON Schema
NameRequiredDescriptionDefault
lastNo15m
levelNo
limitNo
serviceNo
exclude_messagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The verb 'Fetch' implies a read-only operation, but with no annotations and no explicit mention of side effects, authentication, or rate limits, the description only partially carries the transparency burden. It is clear enough for a basic read but lacks deeper behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loaded with the main action and then providing a specific usage hint for one parameter. There is no fluff or irrelevant detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides basic context for the tool's purpose and one parameter but does not mention default behavior, result ordering, or how this tool relates to the sibling tools. Since an output schema is present, return values need not be described, but the parameter gaps and lack of alternative guidance reduce completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains 'service', 'level', and 'exclude_messages' but completely omits 'last' and 'limit'. Since the schema itself provides no descriptions, these two parameters remain ambiguous in terms of format and behavior, leaving a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Fetch latest logs') and a specific resource, with optional filters. It is easily distinguished from sibling tools like get_logs_for_service or get_logs_by_correlation_id by being the general-purpose log retrieval tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to use exclude_messages but gives no explicit guidance on when to choose this tool over sibling tools such as get_logs_for_service or get_logs_by_correlation_id. It does not mention scenarios where one alternative would be preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_logs_by_correlation_idGet Logs By Correlation IdC

Fetch all logs for a correlation/trace/request id. Use exclude_messages to filter out logs matching wildcard patterns (e.g. ["/health", "heartbeat"]).

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
lastNo
limitNo
startNo
correlation_idYes
exclude_messagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only mentions the exclude_messages filter and says 'Fetch all logs' – it doesn't state read-only status, side effects, pagination behavior, rate limits, or what happens if no logs are found. The output schema covers return structure, but behavioral traits beyond that are absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no wasted words. The core purpose is front-loaded, and the second sentence adds a practical usage example for the filter. It's efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, 0% schema coverage, and no annotations, the description is far from complete. It only addresses one parameter and offers no context on time-range filtering, limits, or pagination. The presence of an output schema helps with return values, but input semantics remain largely undocumented, making the tool difficult to use correctly without external knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all six parameters. It only explains exclude_messages with a concrete example. The remaining parameters (end, last, limit, start, correlation_id) are left entirely to the schema, which has no descriptions. This is inadequate for a 6-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch all logs for a correlation/trace/request id' – a specific verb, resource, and scope. It implicitly distinguishes from siblings like get_logs_for_service and get_latest_logs, though it doesn't explicitly name them. It's clear and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (when you have a correlation ID) but provides no explicit guidance on when not to use it or which sibling tool to choose instead. It doesn't mention alternatives or exclusions, leaving usage decisions to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_logs_for_serviceGet Logs For ServiceB

Fetch logs for a service in a chosen time range. Use exclude_messages to filter out logs matching wildcard patterns (e.g. ["/health", "heartbeat"]).

ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
lastNo
levelNo
limitNo
startNo
serviceYes
exclude_messagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of explaining behavior. It only states that logs are fetched and can be filtered by excluded messages, but it does not disclose ordering, pagination, time-boundary interpretation, output format, or any side effects/permissions. This is insufficient for a tool with no annotation support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: two sentences, the first stating the core action and the second giving a concrete filter example. No redundant words or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description is not complete enough for an agent to correctly use the tool. It leaves multiple parameters ambiguous, lacks guidance on how the time-range parameters interact, and does not clarify the relationship to sibling log-fetching tools. The output schema does not replace the missing semantic context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there are 7 parameters. The description only meaningfully explains exclude_messages and vaguely refers to a time range, leaving service, start, end, last, level, and limit unexplained. This does not compensate for the low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'fetch', the resource 'logs for a service', and the key scope 'in a chosen time range'. This distinguishes it from siblings like get_latest_logs or get_logs_by_correlation_id, which target different log retrieval modes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides some usage guidance by explaining how to use exclude_messages with wildcard patterns, but it does not explicitly state when to choose this tool over alternatives such as get_latest_logs or get_logs_by_correlation_id. The 'chosen time range' hint implies one use case, but no clear when-to-use or when-not-to-use guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pingPingA

Check Elasticsearch connectivity and return cluster basics.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes
versionNo
cluster_nameNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. 'Check connectivity and return cluster basics' implies a safe read-only operation, but it does not explicitly disclose side effects, permissions, or failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, direct sentence that conveys the tool's purpose and output with no unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple ping-like tool with no parameters and a minimal output, the description provides enough context for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the schema coverage is effectively complete. The description does not need to explain parameter meaning; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the verb 'Check' and the target 'Elasticsearch connectivity', plus what it returns ('cluster basics'). This distinguishes it from the sibling log-related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The purpose implies using this as a connectivity/health check before log operations, but it does not explicitly state when to prefer it over the sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observeddiagnose_issue
    • First observeddiscover_log_schema
    • First observedget_latest_logs
    • First observedget_logs_by_correlation_id
    • First observedget_logs_for_service
    • First observedping

TDQS

B3.4/5.0

Scored across 6 tools

Disambiguation4/5

Tools are mostly distinct, but get_latest_logs and get_logs_for_service overlap in purpose, differing mainly by time range. diagnose_issue also combines existing functionality but is clearly a convenience wrapper.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern: check_, discover_, get_, diagnose_. No mixed conventions or vague verbs.

Tool Count5/5

6 tools is well-scoped for an Elasticsearch log diagnosis server, covering connectivity, schema discovery, log retrieval, and diagnosis without unnecessary bloat.

Completeness5/5

The toolset covers the full log diagnosis workflow: checking connectivity, discovering schema, fetching logs by time/service/correlation, and a combined diagnosis tool. No obvious missing capabilities for the stated purpose.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    MCP server that transforms raw log query results into structured incident reports (Markdown, JSON, HTML) with correlation to git commits and tickets.
    5
    12 npm
    1
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Minimal MCP server that integrates with Graylog, enabling agents to search, analyze, and inspect log messages across streams, discover fields and streams, and query multiple Graylog instances.
    5
    41 npm
    MIT