Loki: Query Logs
loki_query_logsRun a LogQL query over a time range to retrieve matching log lines across streams, newest first, with paging and label controls for focused troubleshooting.
Instructions
Run a LogQL log query over a time range and return the matching lines, newest first by default, merged across streams into one time-ordered list. Labels shared by every stream come once as common_labels; each line carries only the labels that tell its stream apart, plus level and structured-metadata fields (parsed ones with parsed_fields). When more is true, call again with next's start, end and skip to page on. To count or rank rather than read (errors per namespace, top talkers), use loki_query_metric instead: it is far cheaper than reading lines. loki_get_stats tells you how much a selector would scan.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "loki_query_logs"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | Range end (exclusive): now, now-1h, -30m, an RFC3339 timestamp (2026-01-31T12:00:00Z, nanosecond fractions kept) or unix seconds/nanoseconds. Defaults to now. | |
| skip | No | From `next`: how many lines at the page boundary were already returned. Pass `next` back whole; leave this unset otherwise. | |
| limit | No | Maximum lines to return (1-5000; Loki's own max_entries_limit_per_query may be lower). Defaults to 100. Page with `next` rather than raising it. | |
| query | Yes | A LogQL log query: a stream selector, then filters and parsers, e.g. `{namespace="payments", app="api"} |= "error" != "healthcheck" | json | status >= 500`. Put the cheap parts first: label matchers decide how much is read at all, then line filters (|=, !=, |~), and only then parsers (| json, | logfmt). At least one matcher must not match the empty string: `{app=~".+"}` works, `{app=~".*"}` and `{}` are rejected. | |
| start | No | Range start: now, now-1h, -30m, an RFC3339 timestamp (2026-01-31T12:00:00Z, nanosecond fractions kept) or unix seconds/nanoseconds. Defaults to 1 hour before end. | |
| direction | No | backward: newest lines first, so the limit keeps the most recent. forward: oldest first, to read what happened from the start of the range. | backward |
| hide_labels | No | Stream labels to leave out of the answer. Defaults to ["filename"], which on Kubernetes is a 120-character /var/log/pods/... path repeating namespace, pod and container. Pass [] to see every label. | |
| parsed_fields | No | Include the labels extracted by | json, | logfmt, | regexp or | pattern on each line, under `fields`. Off by default because they restate the line itself and double its size; turn it on after line_format or keep has reshaped the line, or to read a nested JSON value flattened. Structured metadata (trace_id, detected_level) is always included. | |
| max_line_chars | No | Cut each line at this many characters (80-100000); a cut line ends with `… [+N chars]`. Defaults to 2000. Some services log single lines of hundreds of KB. |