service_logs
Read and filter a service's runtime or build logs to debug running apps, find tracebacks, or inspect build output with literal grep and bounded tail queries.
Instructions
Use when: you need the raw output a service or its build printed.
``source`` picks which output you get. **Pass ``source='runtime'`` when
you are debugging a running app** — the build and the app used to share
one stream, so a bare ``grep`` over a deployed app still matches
BuildKit layer chatter (``404B``, ``CACHED``, ``sha256:…``) from the
build that produced it. Lines written by an older daemon are stored as
stdout and therefore read as ``'runtime'`` whichever program printed
them.
``grep`` keeps only lines CONTAINING that text. It is a plain
**literal substring**, never a regex.
All three filters run server-side inside the ``tail`` bound, so ``tail``
counts matching lines: ``grep='Traceback', source='runtime', tail=20``
gives the last 20 app tracebacks out of a million-line log in one
bounded query. Prefer that over pulling a large tail and searching it
yourself.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| grep | No | Keep only lines containing this literal substring (never a regex: no anchors, no character classes, nothing to escape). Truncated to its first 200 characters server-side. Omit to keep every line. | |
| name | Yes | Service name or job id of an existing service (app, model or database); both resolve to the same row. | |
| tail | No | Most recent matching entries to return. Default 100; clamped to [1, 1000] here and bounded again server-side. Counts lines left AFTER ``grep``/``since``/``source``, not lines scanned. | |
| since | No | Keep only lines at or after this ISO-8601 UTC timestamp, inclusive (``2026-08-07T10:00:00Z``). Omit for no lower bound. | |
| source | No | Which stream: ``runtime`` (the container's stdout/stderr plus its crash tail), ``build`` (the image build's output), or ``all`` (the default — both, plus the daemon's own lifecycle lines). Sent only when it is not ``all``; the daemon owns the vocabulary and 422s anything else. | all |
| since_id | No | Exclusive forward cursor: only entries with a larger id. Default 0 = from the start. Ignored whenever ``tail`` is sent — and this tool always sends it — so a page is always the NEWEST matching lines, not the ones after this id. |