Total log volume and distinct pattern count, instant from the rollup.

The highest-volume log patterns, instant from the rollup.

Semantic (meaning-based) search over log patterns — finds related patterns even when they share no keywords. Query embedded server-side; returns cited matches.

The ACTUAL most-recent log lines (real values, not the / template), newest first — for 'what was the latest X', 'show the actual line', recent payment/auth/timeout events (ANY severity). Filter by service, severity, and/or a substring. For a loose 'error/problem' do NOT set severity=ERROR (those usually log as WARN); filter by service or contains.

Top ERROR/FATAL patterns in the last N minutes WITH the window's total volume, so 'no errors' is interpretable; also returns the actual recent error lines.

FLAGSHIP: one call fuses semantic cluster + latest occurrence (with the real log line) + trace causal chain + service graph + rate anomaly, cited. Use for compound incident questions.

Service dependency edges (who calls whom, call counts) from the maintained rollup. Pass a service for depends_on/called_by; omit for the whole graph.

Full-text (BM25) keyword search over log template text.

All spans of one distributed trace, ordered by start time.

One read-only SELECT for a specific filtered lookup. occurrences has a body column = the actual scrubbed log line (recent rows only). No ORDER BY over occurrences (times out); prefer recent_events for actual lines.