Retriever time series
log10x_retriever_seriesBuild a fidelity-aware time series from an S3 archive over any window, with optional group-by. Auto-selects exact or sampled aggregation and reports caveats.
Instructions
Materialize a fidelity-aware time series from the customer's S3 archive over an arbitrary window, with optional group-by on enrichment fields. Auto-selects between exact full aggregation (Strategy A) and per-window-sampled fan-out (Strategy B) based on Reporter pattern volume — small/moderate-volume queries get exact counts; high-volume / long-window queries get a sampled series with time-distribution + group-ranking fidelity preserved and tail caveats reported. Pathological volume is refused with structured narrowing guidance, never silently truncated. Call when: (a) the user wants a 'rate of pattern X over the last 30 days, broken down by tenant' answer that exceeds SIEM retention/budget, (b) a baseline needs building from cost-driver patterns where Prometheus has continuous metrics but the grouped breakdown lives only in the S3 archive. Use log10x_retriever_query instead when you need the actual event payloads (not aggregates).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End of the query window. Same grammar as `from`. Default `now`. | now |
| from | Yes | Start of the query window. ISO8601, epoch millis, or relative (`now-1h`, `now-7d`, `now-30d`). | |
| view | No | summary returns the typed envelope (data.mode, data.bucket_seconds, data.series_count, data.points_returned, data.top_groups, data.caveats, data.human_summary). The deprecated markdown view was removed; data.human_summary carries the prose distillation for chat rendering. | summary |
| search | No | Bloom-filter search expression using the TenX subset. Tightly bound queries (e.g., `includes(text, "<pattern_hash>")`, `severity_level == "ERROR"`) are dramatically cheaper. (legacy example removed: `tenx_user_pattern == "PaymentRetry"`) get the cheapest fetch path. Pattern-bound expressions are also what unlocks the Reporter-driven cost heuristic — without one, mode selection falls back to window-length only. Pass `pattern` instead for the common case of scoping to one Reporter-named pattern. | |
| target | No | Target app prefix. Defaults to __SAVE_LOG10X_RETRIEVER_TARGET__. | |
| filters | No | In-memory JS filters applied after the Bloom-scoped fetch (AND-combined). | |
| pattern | No | Reporter-named pattern (Symbol Message). NOT SUPPORTED against the offload archive: passing it returns an error naming the remedy, rather than a silent empty result. A Symbol Message is a label DERIVED from the event, so it is never a token in the archived bytes, and the Bloom index holds only text tokens plus template hashes. (The field this once queried, `tenx_user_pattern`, does not exist in the engine at all, which is why name-scoped queries returned BLOOM_REJECTED_ALL.) Pass `pattern_hash` instead: top_patterns returns it on the same row as the name, and event_lookup resolves a name to a hash. | |
| fidelity | No | `auto` (tool decides via Reporter volume + window length), `full` (force exact aggregation — may exceed Lambda budget), `per_window_sampled` (force sampling, default K=1000 per sub-window), or `per_window_sampled:K` (custom K). | auto |
| group_by | No | Optional enrichment field to group the series by — e.g., `tenx_user_service`, `severity_level`, `k8s_namespace`. Top-1000 group values are retained; tail collapsed to `_other_`. | |
| bucket_size | No | Time bucket granularity (`1m`, `5m`, `1h`, `1d`). Determines the resolution of the output series. | 5m |
| environment | No | Environment nickname — required if multi-env. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |