get_log_context
Retrieve log entries around a specific timestamp to inspect events before and after a suspicious error or state change. Scope by trace ID, pod, or service.
Instructions
Returns the log entries within a time window around a specific timestamp. Use this when you've found a suspicious entry (an error, a state change, etc.) and need to see what happened immediately before and after (the human equivalent of clicking 'view surrounding documents' in Kibana/Discover).
Default window is ±60 seconds (so 120s total). Narrow it with window_seconds for noisy services, widen for sparse logs.
Use trace_id (filters on logs.contextMap.traceId, TRACE_ID_FIELD env) or include_filters to scope to the same trace, pod, or service. Otherwise you'll see ALL traffic in the window, which is often too much.
Pass query only if you also want to constrain by a search term in the window; usually leave it empty.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Max hits in window (must be ≥ 1). Default 200. | |
| level | No | Filter on the level field (LEVEL_FIELD env, default logs.level; currently `logs.level`), e.g. 'ERROR' or ['ERROR','WARN']. Prefer this over putting ERROR in query, which also matches INFO messages containing the word error. | |
| query | No | Optional text search applied within the window. Leave empty to see ALL logs around the timestamp (most common usage). An empty string or '*' matches all documents. The text is matched against these fields: message, logs.message, msg, log, logs.loggerName, logs.thread, logs.thrown.name, logs.thrown.message, logs.request, logs.requestFirstLine (override with the QUERY_FIELDS env var). | |
| trace_id | No | Scope the window to one trace: adds an include filter on `logs.contextMap.traceId` (override the field with the TRACE_ID_FIELD env var). | |
| query_dsl | No | Raw OpenSearch/Elasticsearch query DSL clause, AND-ed into the bool filter alongside `query` and the time range. Use for anything the plain text query can't express: numeric ranges ({range: {status: {gte: 500}}}), wildcards ({wildcard: {'url.keyword': '/api/*'}}), OR logic ({bool: {should: [...], minimum_should_match: 1}}), exists checks, etc. | |
| timestamp | Yes | The pivot ISO 8601 timestamp (e.g. '2026-05-06T06:49:57.647Z'). Take this from a previous search hit's @timestamp. | |
| environment | No | Which dashboard environment to search, as configured in the extension popup. The extension has not reported any environments yet, so omit this unless the user names one. | |
| full_message | No | ||
| display_fields | No | Same fallback chain as search_logs. | |
| window_seconds | No | Half-window size in seconds. Default 60 (so total span = ±60s = 120s). | |
| exclude_filters | No | ||
| include_filters | No | Highly recommended: scope by traceId, pod_name, or service to avoid drowning in unrelated traffic. |