Skip to main content
Glama
log-10x

Log10x MCP Server

Official
by log-10x

Retriever time series

log10x_retriever_series
Read-onlyIdempotent

Build a fidelity-aware time series from an S3 archive over any window, with optional group-by. Auto-selects exact or sampled aggregation and reports caveats.

Instructions

Materialize a fidelity-aware time series from the customer's S3 archive over an arbitrary window, with optional group-by on enrichment fields. Auto-selects between exact full aggregation (Strategy A) and per-window-sampled fan-out (Strategy B) based on Reporter pattern volume — small/moderate-volume queries get exact counts; high-volume / long-window queries get a sampled series with time-distribution + group-ranking fidelity preserved and tail caveats reported. Pathological volume is refused with structured narrowing guidance, never silently truncated. Call when: (a) the user wants a 'rate of pattern X over the last 30 days, broken down by tenant' answer that exceeds SIEM retention/budget, (b) a baseline needs building from cost-driver patterns where Prometheus has continuous metrics but the grouped breakdown lives only in the S3 archive. Use log10x_retriever_query instead when you need the actual event payloads (not aggregates).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
toNoEnd of the query window. Same grammar as `from`. Default `now`.now
fromYesStart of the query window. ISO8601, epoch millis, or relative (`now-1h`, `now-7d`, `now-30d`).
viewNosummary returns the typed envelope (data.mode, data.bucket_seconds, data.series_count, data.points_returned, data.top_groups, data.caveats, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering.summary
searchNoBloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, "<pattern_hash>")`, `severity_level == "ERROR"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == "PaymentRetry"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic — without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern.
targetNoTarget app prefix. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__.
filtersNoIn-memory JS filters applied after the Bloom-scoped fetch (AND-combined).
patternNoReporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash.
fidelityNo`auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation — may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K).auto
group_byNoOptional enrichment field to group the series by — e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`.
bucket_sizeNoTime bucket granularity (`1m`, `5m`, `1h`, `1d`). Determines the resolution of the output series.5m
environmentNoEnvironment nickname — required if multi-env.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dataNo
toolYes
viewNosummary
imagesNo
actionsNo
summaryYes
warningsNo
truncatedNo
next_cursorNo
render_hintNo
generated_atYes
schema_epochYes
schema_versionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.30.7

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare read-only/idempotent/open-world; the description goes well beyond by disclosing the auto strategy-selection heuristic (volume + window length), the sampling behavior with fidelity guarantees, that tail caveats are reported, and that pathological volume is refused with structured narrowing guidance rather than silently truncated. That is exactly the behavioral context an agent needs to set expectations on output reliability.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core capability, then conditions, then the alternative. It is dense but nearly every clause carries information; the two long sentences are packed with nested parentheticals, which costs a little readability but not correctness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return-shape explanation is unnecessary, and the description still covers the operation's mode, its fidelity caveats, its refusal behavior, and routing to the payload-fetching sibling. Nothing material is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema carries the heavy lifting and baseline is 3. The description adds how the fidelity tradeoff plays out (small/moderate volume = exact counts vs high-volume = sampled) and references group-by on enrichment fields, which gives callers a reason to pick `full` vs `per_window_sampled` beyond the bare enum values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (materialize) + resource (fidelity-aware time series) + scope (S3 archive over an arbitrary window, optional group-by). It explicitly contrasts itself with the sibling log10x_retriever_query ('actual event payloads, not aggregates'), so an agent can distinguish them without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States two concrete when-to-use conditions (a) breakdown answers exceeding SIEM retention and (b) building baselines where grouped breakdowns live only in the archive, plus an explicit when-not with a named alternative. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.