Page messages of a search job (non-aggregate; primitive)
sumo_get_messagesRetrieve paginated log messages from a non-aggregate search job with configurable detail levels, sorting, deduplication, and field projection.
Instructions
Pages messages of a NON-aggregate search job (aggregate jobs 400 — use sumo_get_records). Page size max 10000. Partial results are pageable while the job is still gathering. Token levers: detail=summary (whole-job counts by the AUTO-DETECTED severity field — exact via a side-aggregate with disclosed provenance, or a loud SAMPLE label if that fails — plus a compact histogram and top message signatures; cheapest) | compact (timestamp, level, request_id, _sourcecategory, FULL message, plus method/path/status when present) | full (compact + duration_s/logger/client_ip) | raw (verbatim _raw — logs exactly as the app emitted them, including anything sensitive it logged). See the fields/dedupe/maxMessageChars params for projection, grouping, and the message-length cap.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Search job id. | |
| sort | No | Order of returned messages by _messagetime (default "asc" = oldest→newest, best for tracing). Client-side: orders only the RETURNED result set — raise limit or narrow the query for full ordering. Not applicable to aggregate records. | |
| limit | No | Page size (default 100). | |
| dedupe | No | Group repeated messages within the RETURNED page by (level, signature) — timestamps/UUIDs/hex/numbers are normalized away — rendering "first_ts..last_ts LEVEL ×N message". Raise limit for broader grouping (only fetched rows are grouped). With detail:"raw", each group keeps one verbatim _raw exemplar. | |
| detail | No | Output verbosity (default compact). | |
| fields | No | Explicit field projection from the flattened namespace (level/request_id always kept). | |
| format | No | Output mode (default text). | |
| offset | No | Start offset (default 0). | |
| maxMessageChars | No | Safety cap for the message field (default 10000); the message is never truncated by default. |