Skip to main content
Glama
Rootly MCP server

Rootly MCP server

Official
by rootlyhq

List Observability Logs

list_observability_logs
Read-only

Search Rootly Observability logs by service, severity, index, trace ID, attributes, or free text, then page through newest-first results within a specified time window.

Instructions

Search Rootly Observability logs with the Logs explorer query syntax (service:, severity:, index:, trace_id:, @attribute:value, OR inside field groups, - negation, * prefix, free text). Rows are newest first, clipped and redacted. meta.query and meta.window echo the effective query and window. Requires a personal or Global API key (Team API Keys are group-scoped and get 403 unsupported_api_key) or an OAuth token with the obs.logs:read (or all) scope, and the Observability logs read permission. A Global API key uses its service user's Observability role, which starts as the team's default Observability role. Limited to 60 requests per minute per token; on this endpoint the X-RateLimit-* headers report that per-minute budget, not the default API limit. Every 429 returns the errors envelope with code rate_limited and a Retry-After header.

Input Schema

NameRequiredDescriptionDefault
filter_toNoWindow end: ISO8601 or relative like `now`. Defaults to `now`.
page_sizeNoMaximum rows per page (1-50, default 25). A page can hold fewer rows when the response size budget is reached; keep paging while meta.page.next_cursor is present.
filter_fromNoWindow start: ISO8601 or relative like `now-6h`, `now-30m`, `now-2d`. Defaults to `now-1h`. Windows are at most 7 days, and 24 hours without an indexable term.
page_cursorNo`meta.page.next_cursor` from the previous page. Keeps that page's window; send the same `filter[query]`.
filter_queryNoLogs explorer query, e.g. `service:checkout severity:error index:main`.

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv2.4.0

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the readOnly/openWorld annotations: newest-first ordering, clipping and redaction of rows, meta.query/meta.window echo, per-minute rate budget with X-RateLimit-* semantics differing from the default API limit, and the exact 429 error envelope with code rate_limited plus Retry-After. It also documents the specific 403 failure mode (unsupported_api_key) for Team API keys, which is exactly the kind of behavioral detail an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with query capability, then auth, then rate limits, then errors – a sensible order and nearly every sentence carries operational weight. It is dense and long for a list tool, with the rate-limit sentence being the one place that could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema available, the description doesn't waste space on return fields, yet it still covers the things the schema can't: ordering, redaction, auth prerequisites, pagination continuation, window caps and rate-limit behavior. Nothing an agent needs before invoking it is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds genuine semantics: it enumerates the supported Logs explorer operators (service:, severity:, index:, trace_id:, @attribute, OR, -, *) that the filter_query schema only gestures at with one example. The paging contract (keep paging while meta.page.next_cursor is present, reuse the same filter[query]) is also reinforced in prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a specific verb and resource ('Search Rootly Observability logs') plus the query-language scope, which clearly separates it from unrelated CRUD siblings. It never names the adjacent tools (count_observability_logs, list_observability_patterns), so sibling differentiation is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real selection context: required key type (personal/Global API key, or OAuth with obs.logs:read/all), the Observability logs read permission, and the 7-day/24-hour window constraints that determine whether the call can succeed at all. It stops short of stating when to prefer count_observability_logs or list_observability_patterns instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools