Skip to main content
Glama
yunusemregul

Kibana Bridge MCP

by yunusemregul
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

inspect_log

Retrieve the full _source of a log entry as YAML to inspect traceId, Kubernetes labels, exception stacks, and request bodies. Pass full:true for untruncated metadata.

Instructions

Returns the _source of one log entry as YAML. Use this when search shows a tantalizing single message and you need the full metadata: traceId, kubernetes labels, exception stack, request body, etc.

By default the output is trimmed to stay readable: the raw log string is dropped when its parsed logs.* object is present, every extendedStackTrace keeps its first 5 frames, kubernetes.annotations is collapsed to a count, and strings over 4000 chars are cut. Pass full: true to get the untouched _source.

Identifies the doc by timestamp (ISO with millisecond precision is usually unique). If multiple docs share the timestamp, pass include_filters (e.g. pod_name) to disambiguate. Only the first match is returned.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
fullNoIf true, return the complete `_source` with no truncation (stack traces, annotations, duplicate raw `log`). Default false.
timestampYesExact ISO 8601 timestamp to match (e.g. '2026-05-06T06:49:57.647250Z').
environmentNoWhich dashboard environment to search, as configured in the extension popup. The extension has not reported any environments yet, so omit this unless the user names one.
include_filtersNoOptional disambiguation if multiple docs share the timestamp.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.2

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it enumerates exactly what default trimming destroys (raw `log` dropped, stack traces cut to 5 frames, annotations collapsed, strings over 4000 chars cut), how to opt out with `full: true`, that only the first match is returned, and that the extension has no configured environments. This is unusually rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short paragraphs, front-loaded with purpose then behavior then identification strategy; every sentence earns its place. The trimming details are somewhat restated between the body and the `full` parameter description, a minor redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations exist, yet the description specifies the return format (YAML `_source`), the default trimming behavior, the escape hatch, and the match-selection semantics. Nothing needed to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: it explains why `timestamp` is the primary key and when it is insufficient, and frames `include_filters` as a disambiguation mechanism rather than a generic filter. It does not add syntax beyond the schema, keeping it below 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Returns the `_source` of one log entry as YAML') and immediately contrasts it with search by framing the trigger as 'when search shows a tantalizing single message and you need the full metadata.' An agent can distinguish this from search_logs and get_log_context without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear when-to-use condition (after a search surfaces one interesting message) and explains the disambiguation path when the timestamp is not unique. It never explicitly names a sibling tool or states when-not-to-use, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools