summarize_logs
Returns a token-light summary of log queries: total hits, time histogram, and top values, so you can see data shape and choose filters before searching.
Instructions
Returns a cheap summary of a log query: total hits, time histogram, and top-N values for chosen dimensions. Use this BEFORE search_logs to see the shape of the data and decide which exclude_filters to apply. No hits are returned (size=0), so this is very cheap on tokens even over 7-day windows.
Typical first call for an investigation: summarize_logs(query, minutes_lookback: 10080). It gives you total hits per day and the noisy dimensions to exclude in the follow-up search.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| level | No | Filter on the level field (LEVEL_FIELD env, default logs.level; currently `logs.level`), e.g. 'ERROR' or ['ERROR','WARN']. Prefer this over putting ERROR in query, which also matches INFO messages containing the word error. | |
| query | Yes | Same as search_logs. An empty string or '*' matches all documents. The text is matched against these fields: message, logs.message, msg, log, logs.loggerName, logs.thread, logs.thrown.name, logs.thrown.message, logs.request, logs.requestFirstLine (override with the QUERY_FIELDS env var). | |
| top_n | No | Top values per field. Default 10. | |
| time_to | No | Absolute end time, ISO 8601. Without time_from, the window starts minutes_lookback before this. | |
| query_dsl | No | Raw OpenSearch/Elasticsearch query DSL clause, AND-ed into the bool filter alongside `query` and the time range. Use for anything the plain text query can't express: numeric ranges ({range: {status: {gte: 500}}}), wildcards ({wildcard: {'url.keyword': '/api/*'}}), OR logic ({bool: {should: [...], minimum_should_match: 1}}), exists checks, etc. | |
| time_from | No | Absolute start time, ISO 8601 (e.g. '2026-09-23T10:28:00Z'). Without time_to, the window runs from here to now. | |
| environment | No | Which dashboard environment to search, as configured in the extension popup. The extension has not reported any environments yet, so omit this unless the user names one. | |
| search_type | No | ||
| exclude_filters | No | Same as search_logs: apply prior excludes so the summary reflects the narrowed set. | |
| include_filters | No | ||
| aggregate_fields | No | Dotted field paths to bucket by. Default ["logs.level","logs.loggerName","logs.thrown.name","kubernetes.pod_name"]. The server appends '.keyword' automatically when needed. Discover valid paths with available_log_fields. | |
| minutes_lookback | No | Window length in minutes. Default 15. With neither time_from nor time_to it means the last N minutes up to now; with only time_to it means the N minutes ending at time_to; ignored when time_from is given. The response header always shows the resolved absolute UTC window. |