Learn a scope's log schema in depth (propose-only)
sumo_describe_schemaDiscovers the schema of log data by stratified sampling: enumerates nested JSON keys, characterizes string payloads, and provides ranked severity fragments. Use when digest shows no-signal or for first contact with a new system.
Instructions
Thorough schema learner — the deep counterpart to the lite auto-detection inside sumo_error_digest/sumo_trend: STRATIFIED-samples the scope (per category × type/stream stratum, spread across message shapes — never first-N rows), enumerates top-level AND nested JSON keys (fill %, inferred types incl. float-strings, top values; arrays marked []), characterizes string payloads (format + severity-ish token hits) instead of returning an empty schema, breaks fields out per stratum, and closes with RANKED paste-ready severity fragments for the filter= param — each with honest caveats. It PROPOSES, never decides: it applies no filters and persists nothing; record what you confirm in your own memory. Use when a digest disclosed no-signal/zero-match or on first contact with a new system. Job budget: 2-4 aggregate jobs + 1-6 bounded page jobs, all auto-deleted. Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| query | Yes | Scope query (keywords + metadata filters; no | operators). | |
| maxDepth | No | Nested-key flattening depth (default 4); arrays marked []. | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| sampleSize | No | Messages sampled for key enumeration (default 200, cap 1000). | |
| stratifyBy | No | Explicit stratification field: an absolute JSON path from the _raw root (e.g. log.type, stream). Default: auto-detected (log.type, then stream, then category-only). | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). |