[READ] List defined Log Insight alerts.

name_filter = optional case-insensitive substring on alert name. limit = max results (default 50). target = target name from config. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, name, enabled, info}. Start here, then pass an id to alert_get or alert_history. total is the real count matching name_filter, so truncated answers whether more exist; raise limit or narrow name_filter when true. Read-only — this skill never creates/edits/deletes alerts.

[READ] Get full details for one alert. Use this after alert_list; alert_id = the id it returned. target = target name from config. Returns the alert's sanitized detail; for its firings use alert_history. Read-only.

[READ] List recent trigger-history records for an alert.

Use this for when an alert fired, not how it's defined. alert_id = the alert id (from alert_list). limit = max records (default 50). target = target name from config. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {timestamp_ms, info}. total is the real history-record count, so truncated answers whether older records were left behind — raise limit when true. Read-only.

[READ] Search Log Insight events within a time window.

WHEN: to find the actual log lines behind an incident (e.g. what vmkernel logged during a storage event). For "where did logs burst?" use log_aggregate instead; for vCenter alarms use vmware-monitor.

INPUT: text = free-text search (CONTAINS). last = relative window like "1h", "30m", "7d" (defaults to last hour). begin_ms/end_ms = absolute epoch-ms window (mutually exclusive with last). limit = max events (1..20000, default 50 — narrow with text, don't raise it). target = target name from config.

RETURNS: {count, complete (False if truncated), constraints, events: [{timestamp_ms, text, fields}]}. Feed events to vmware-debug incident_timeline to correlate across sources. Read-only.

[READ] Aggregate matching events into a time series and detect spikes.

WHEN: to find when/whether log volume burst without pulling raw events. Follow up with log_search on the spike window.

INPUT: text/last/begin_ms/end_ms = same query semantics as log_search. aggregation = COUNT|UCOUNT|AVG|MIN|MAX|SUM|STDDEV|VARIANCE|SAMPLE (default COUNT). bin_width_ms = bin width in ms (default 60000). target = target name from config.

RETURNS: {aggregation, bin_width_ms, constraints, bins:[{timestamp_ms, value}], spikes:[{timestamp_ms, value, zscore}]}. Read-only.

[READ] List the extracted fields available to use in query filters.

Use this to discover valid field names before filtering log_search / log_aggregate. name_filter = optional case-insensitive substring. target = target name from config. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {name}. No limit — every matching field is returned, so truncated is always false: this is the complete field list, not a page. Read-only.

[READ] Return the Log Insight appliance version/build (diagnostics and query-syntax compatibility). target = target name from config. Use this first when a query behaves unexpectedly, to confirm the appliance version before trusting log_search. Read-only.