cd log-pruner
pip install -r requirements.txt

export OPENSEARCH_URL="https://your-opensearch-cluster:9200"
export OPENSEARCH_USER="admin"
export OPENSEARCH_PASSWORD="secret"

{
  "mcpServers": {
    "log-pruner": {
      "command": "python",
      "args": ["/absolute/path/to/log-pruner/server.py"]
    }
  }
}

{
  "mcpServers": {
    "log-pruner-dev": {
      "command": "python",
      "args": ["/absolute/path/to/log-pruner/server.py"],
      "env": {
        "OPENSEARCH_URL": "https://dev-opensearch-cluster:9200",
        "OPENSEARCH_USER": "admin",
        "OPENSEARCH_PASSWORD": "dev-password"
      }
    },
    "log-pruner-staging": {
      "command": "python",
      "args": ["/absolute/path/to/log-pruner/server.py"],
      "env": {
        "OPENSEARCH_URL": "https://staging-opensearch-cluster:9200",
        "OPENSEARCH_USER": "admin",
        "OPENSEARCH_PASSWORD": "staging-password"
      }
    }
  }
}

## Log Analysis

When the user provides a log file or asks to analyze/debug logs:
- Do NOT read the file with the built-in Read tool — it will flood context
- Pass the file path to the log-pruner MCP tools which strip ~98% of noise:
  - `mcp__log-pruner__read_logs` — compact table from any log file
  - `mcp__log-pruner__summarize_logs` — overview (level distribution, top loggers, error rates)
  - `mcp__log-pruner__get_errors` — all errors with full detail
  - `mcp__log-pruner__get_context` — entries around a specific timestamp
  - `mcp__log-pruner__query_logs` — query live OpenSearch (requires env vars)

read_logs(path="app.log")
→ 1327 app log entries
  TIMESTAMP                | LVL    | THREAD                        | MESSAGE
  2026-06-06T15:12:44Z     | INFO   | main                          | Starting application
  2026-06-06T15:12:45Z     | ERROR  | http-nio-8080-exec-1          | NullPointerException at line 42
  2026-06-06T15:12:46Z     | WARN   | scheduler-1                   | Job took 5000ms

read_logs(path="access.log", status_filter="5xx")
→ 3 hits (of 50000 total)
  TIMESTAMP                | ST  |    MS |  BYTES | FROM            | REQUEST
  12/Jun/2026:10:53:07Z    | 500 |       |     56 | 10.0.0.2        | POST /api/login
  12/Jun/2026:10:53:09Z    | 502 |       |      0 | 10.0.0.3        | GET /api/users

read_logs(path="pod-logs.json")
→ 500 app log entries
  TIMESTAMP                | LVL    | THREAD                        | MESSAGE
  2026-06-06T15:12:44Z     | ERROR  |                               | Connection refused
  2026-06-06T15:12:45Z     | INFO   |                               | Retrying in 5s...

summarize_logs(path="deployment.log")
→ === App Log Summary (3808 entries) ===

  Level distribution:
    INFO: 3749 (98.5%)
    WARN: 55 (1.4%)
    ERROR: 4 (0.1%)

  Top 10 loggers:
    3012x  de.hybris.platform.impex.jalo.imp.ImpExWorker
     215x  de.hybris.platform.servicelayer.impex.impl.DefaultImportService
     ...

  Warnings/Errors (22 unique):
    [WARN] column absolute of type Discount is read-only...
    [ERROR] Can not resolve any more lines...

get_errors(path="deployment.log")
→ === ImpEx Failures (3) ===

  [IMPEX FAILURE] 2026-06-06T15:12:46Z
    Thread:  main
    Logger:  de.hybris.platform.impex.jalo.cronjob.ImpExImportJob
    Message: Can not resolve any more lines ... Aborting further passes (at pass 3).

  === Errors (2) ===

  [ERROR] 2026-06-06T15:12:46Z
    Thread:  main
    Logger:  de.hybris.platform.core.Initialization
    Message: SystemSetupException: Impex import failed for : '00037874-ImpEx-Import'

1. read_logs(path="file.log")                    → Quick scan (compact, low tokens)
2. summarize_logs(path="file.log")               → Level distribution, top loggers
3. get_errors(path="file.log")                   → All errors + ImpEx failures
4. get_context(path="file.log", timestamp="..")  → Entries around a specific time