Skip to main content
Glama
log-10x

Log10x MCP Server

Official
by log-10x

Triage

log10x_resolve_batch
Read-onlyIdempotent

Templatizes a batch of log events locally and returns per-pattern triage with frequency, severity, and slot distributions. Runs in-process without Kubernetes or a Log10x account.

Instructions

Templatize a batch of log events and return per-pattern triage. This is one of two tools that ACTUALLY RUN A LOCAL LOG10X PIPELINE on the user's machine (the other is log10x_extract_templates) — call this whenever the user asks 'can you run log10x locally', 'do a local pipeline run', 'templatize these events', or supplies any batch to analyze (Datadog/Splunk/Elastic query results, Slack incident attachments, kubectl logs, raw text). Does NOT need Kubernetes, a deployed Reporter, or a Log10x account — the pipeline runs in-process on the host. Output structures the batch by a paste-local templateHash with per-pattern frequency + severity + full template structure + per-slot variable distribution. Each top pattern carries actions[] chaining to log10x_investigate (historical correlation) and log10x_retriever_query (archive retrieval). Do NOT call for single-line resolution — use log10x_event_lookup for that. REQUIRES a local engine: the tenx binary on PATH, or Docker with LOG10X_TENX_MODE=docker.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathNoLocal file path when source=file. Required for file mode.
textNoRaw text blob when source=text — newline-separated log events.
eventsNoInline log lines: an array of lines, or a single newline-separated string (both accepted). `source` need not be set.
sourceNoOptional — auto-inferred from whichever of `events` / `text` / `path` you actually provide, so you normally do not set it. Provide explicitly only to disambiguate when more than one is present.
environmentNoEnvironment nickname — used to build next_actions that call log10x_investigate.
top_n_patternsNoHow many patterns to return in the ranked triage.
include_next_actionsNoWhether to generate next_action suggestions for each top pattern.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dataNo
toolYes
viewNosummary
imagesNo
actionsNo
summaryYes
warningsNo
truncatedNo
next_cursorNo
render_hintNo
generated_atYes
schema_epochYes
schema_versionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.30.7

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnly/idempotent/openWorld, and the description goes well beyond them: it discloses the hard prerequisite (tenx binary on PATH or Docker with LOG10X_TENX_MODE=docker), what is NOT required (Kubernetes, deployed Reporter, Log10x account), that the pipeline runs in-process, and the shape of the returned triage including actions[] chaining. This is genuinely non-obvious operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action and usage triggers first, then prerequisites. It is dense and slightly over-long, but nearly every sentence carries routing or prerequisite value rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't detail return values, yet it still summarizes the triage structure and downstream chaining. Combined with full schema coverage and annotations, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all seven parameters including source inference and top_n_patterns bounds, making 3 the baseline. The description adds only marginal per-parameter meaning (e.g. that `environment` feeds next_actions), without new syntax or format detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Templatize a batch of log events and return per-pattern triage') and explicitly positions itself against siblings, naming both the parallel pipeline tool (`log10x_extract_templates`) and the excluded single-line tool (`log10x_event_lookup`). An agent can distinguish it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit trigger phrases ('can you run log10x locally', 'do a local pipeline run', 'templatize these events') plus concrete input sources (Datadog/Splunk/Elastic results, Slack attachments, kubectl logs, raw text). It also states when NOT to use it, routing single-line cases to `log10x_event_lookup`.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.