kibana_search_logs
Search Elasticsearch logs with Query String Syntax, returning the top matching entries including their _source fields. Filter by time range and sort by order.
Instructions
Search logs using Elasticsearch Query String Syntax.
Wraps POST {ES_URL}/{index}/_search with a bool/must query.
Returns the top matching log entries with their _source fields.
When more than 20 hits are rendered in the text output, a truncation
hint is appended — use the structured hits field for the full list.
Examples:
- Use when: "Show me the last 20 ERROR logs from the API service."
→ index='logs-*', query='level:ERROR AND service:api'.
- Use when: "Find 'connection refused' errors in the last hour."
→ query='message:"connection refused"',
time_from='2026-04-18T09:00:00Z', time_to='2026-04-18T10:00:00Z'.
- Use when: "Show me 500 errors sorted oldest first for replay."
→ query='status:500', sort_order='asc'.
- Don't use when: You want counts / statistics per field value —
use kibana_aggregate_logs instead (size:0 aggregation is
much cheaper than retrieving full log documents).
- Don't use when: You need more than 500 docs — ES caps size at
500 via this tool; use scroll API directly for bulk export.
Returns:
dict with total / returned / took_ms / hits (list).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | Elasticsearch index name or pattern (e.g. 'logs-*', 'filebeat-2026.04.18'). Use `kibana_list_indices` to discover available indices. | |
| query | Yes | Elasticsearch Query String Syntax. Examples: 'level:ERROR', 'level:ERROR AND service:api', 'message:"connection refused" AND host:db*', 'status:[500 TO 599]'. Use '*' to match all documents. | |
| time_field | No | Name of the timestamp field. Default '@timestamp' (Logstash/Filebeat convention). | @timestamp |
| time_from | No | Start of the time range. ISO-8601 (e.g. '2026-04-18T00:00:00Z') or epoch-ms (e.g. '1713398400000'). Omit for unbounded start. | |
| time_to | No | End of the time range. ISO-8601 or epoch-ms. Omit for unbounded end (searches up to now). | |
| size | No | Maximum number of log hits to return (1-500, default 20). | |
| sort_order | No | Sort order for results: 'desc' (newest first, default) or 'asc' (oldest first). | desc |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| total | Yes | ||
| returned | Yes | ||
| took_ms | Yes | ||
| index | Yes | ||
| query | Yes | ||
| time_from | Yes | ||
| time_to | Yes | ||
| sort_order | Yes | ||
| hits | Yes |