Search historical logs across pods and restarts in a connected or Ankra hosted store (Loki, Elasticsearch, OpenSearch, VictoriaLogs). get_pod_logs reads one live pod. Use structured filters (namespaces/pods/containers plus a text search) or raw_query for a provider expression (LogQL on Loki, a JSON query-DSL clause on Elasticsearch/OpenSearch, LogsQL on VictoriaLogs). Results are normalized {timestamp, line, labels, fields} entries, newest first by default, truncated to the limit. Every result carries cluster_attribution, because one log store can be shared by several clusters (the Ankra platform clusters ship their platform namespace into the same OpenSearch indices with identical pod names): when the store attributes lines to clusters (a `cluster` field on Elasticsearch/OpenSearch, a `cluster` stream label on Loki, stamped by the shipper) the query is scoped to this cluster's value, and lines attributed to other clusters or carrying no attribution are excluded and counted (other_clusters_hits, unattributed_hits; absent when the store cannot count them). cluster_attribution.state is "attributed" (scoped; this cluster's lines exist in the window), "requested_absent" (the store attributes other clusters' lines but none in the window carries this cluster's value - the result is empty and nothing in the store can be attributed to this cluster; report that, never substitute unattributed lines), or "none" (no line in the window carries the field; the result is NOT scoped and, if the store is shared, may include other clusters' lines - say so). Relay the note. On a scoped Loki store raw_query is refused; use the structured filters, which are scoped automatically. On Elasticsearch/OpenSearch each entry's fields object carries the requested extra _source paths (default: level and extra, the platform's structured-attribute container - cluster_id, error, etc.); pass fields to pick different paths. Attributes indexed as flat_object match on exact full leaf values only, via dotted paths in raw_query (e.g. {"match": {"extra.cluster_id": "<uuid>"}}) - substring search inside attribute values is not supported by the store. total_hits_relation says how to read total_hits: "eq" means it is the exact number of matches, "gte" means the store stopped counting (Elasticsearch and OpenSearch cap at index.max_result_window, 10,000 by default) and total_hits is only a floor - in that case say "at least N", never state it as the exact count. Use this for 'what errored around 14:00', cross-pod correlation, and logs from restarted/deleted pods. group_by="signature" answers 'what errored in this window' without the error text: errors grouped into signatures (container, normalised message, count, first/last seen, sample, history new/recurring/unknown vs the prior 7 days; never call unknown new). counts_are_exact false means counts are floors. Read-only.