query_logs
Query OpenSearch logs with Lucene queries, filter by time range, HTTP status, and response time, and return a compact log table.
Instructions
Query OpenSearch directly and return compact log table. Requires OPENSEARCH_URL env var.
Args: index: OpenSearch index pattern (e.g. "logs-json-"). query: Lucene query string (e.g. "status:500 AND logs.requestFirstLine:/api/users*"). time_from: ISO timestamp lower bound (e.g. "2026-06-03T01:00:00Z"). time_to: ISO timestamp upper bound. limit: Max entries to fetch (default 50). status_filter: Client-side filter by HTTP status after fetch. min_response_time: Client-side filter by min response time (ms).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| limit | No | ||
| query | No | ||
| time_to | No | ||
| time_from | No | ||
| status_filter | No | ||
| min_response_time | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |