Read an OpenSearch log file (JSON or CSV) and return compact log table. Strips kubernetes metadata, duplicate fields — ~98% token reduction. Supports both HTTP access logs and application logs (auto-detected).

Args: path: Path to the OpenSearch JSON or CSV export file. limit: Max entries to return (default 100). status_filter: Only show entries with this HTTP status (e.g. "500", "4xx"). Only applies to HTTP access logs. min_response_time: Only show entries slower than this (ms). Only applies to HTTP access logs. time_from: ISO timestamp lower bound filter (e.g. "2026-06-03T01:05:05Z"). time_to: ISO timestamp upper bound filter.

Query OpenSearch directly and return compact log table. Requires OPENSEARCH_URL env var.

Args: index: OpenSearch index pattern (e.g. "logs-json-"). query: Lucene query string (e.g. "status:500 AND logs.requestFirstLine:/api/users*"). time_from: ISO timestamp lower bound (e.g. "2026-06-03T01:00:00Z"). time_to: ISO timestamp upper bound. limit: Max entries to fetch (default 50). status_filter: Client-side filter by HTTP status after fetch. min_response_time: Client-side filter by min response time (ms).

Aggregate log summary: top endpoints, error rates, slowest requests, unique IPs. Provide either path (file) or index (API).

Args: path: Path to local OpenSearch JSON file. index: OpenSearch index to query (requires OPENSEARCH_URL env). query: Lucene query string for API mode. time_from: ISO timestamp lower bound for API mode. time_to: ISO timestamp upper bound for API mode. limit: Max entries to analyze (default 200).

Get full detail for non-200 responses (errors). Shows stack traces, log bodies, pod info — everything needed for troubleshooting.

Args: path: Path to local OpenSearch JSON file. index: OpenSearch index to query (requires OPENSEARCH_URL env). query: Additional Lucene query for API mode. time_from: ISO timestamp lower bound. time_to: ISO timestamp upper bound. limit: Max error entries to return (default 20). context_before: Number of log entries to show before each error (default 0). Set to 20 to see what happened leading up to the error.

Get full log entries around a specific timestamp — like grep -C for logs. Shows what happened before and after an event for troubleshooting.

Args: path: Path to local OpenSearch JSON file. index: OpenSearch index to query (requires OPENSEARCH_URL env). timestamp: Center timestamp (ISO format, e.g. "2026-06-03T01:05:05Z"). window_seconds: Seconds before and after timestamp to include (default 5). pod: Optional pod name filter — only show entries from this pod. limit: Max entries to return (default 50).