Overflow contents
log10x_overflow_contentsReview the offload S3 bucket contents to see per-pattern bytes, event counts, and growth rates, answering what's accumulating in your overflow queue.
Instructions
The contents view of the customer-owned offload S3 bucket — per-pattern bytes, event count, time-first-seen, time-last-seen, and growth rate. Filtered to action=offload via the cap-CSV the MCP wrote (drop patterns are NOT in S3; compact and tier_down route elsewhere). Call this as the maintenance-loop review: "what's accumulating in my overflow queue?" Routes the agent to log10x_retriever_query for rehydration when an incident or audit needs the data back in the SIEM.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | Output format. Always "summary" — the typed envelope (data.patterns[], data.totals). | summary |
| limit | No | Cap on the number of per-pattern rows returned. Total bytes always reflect the full overflow, even when rows are truncated. | |
| service | No | Filter to a single service. Omit for the full overflow queue across every service that routes to S3. | |
| timeRange | No | Window over which to compute overflow contents. 30d matches the maintenance-loop cadence; sub-30d windows for incident-window probes. '24h' and '1d' are equivalent. | 30d |
| environment | No | Environment nickname |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |