Skip to main content
Glama
ThoTischner

observability-mcp

by ThoTischner

query_logs

Read-onlyIdempotent

Fetch recent logs for a service over a look-back window with error/warning counts and top error patterns to investigate spikes. Filter with labels or aggregate server-side for counts.

Instructions

Fetch recent log entries for ONE service over a look-back window, with a pre-computed summary (error/warning counts and the most frequent error patterns). When to use: to inspect what a service actually logged, or to investigate an error spike surfaced by detect_anomalies / get_service_health. For numeric metrics use query_metrics instead. Golden rule: filter + aggregate server-side — pass labels to scope and aggregate (count_over_time/sum/topk) to get numbers, not raw rows. A high-volume window returned raw will blow past your context limit. Prerequisites: get the exact service name from list_services (the service must expose a logs signal). Behavior: read-only, no side effects. Returns the matching log entries (newest first, capped by limit) plus a summary with total/error/warn counts and top recurring error patterns. No matches yields an empty result with a zeroed summary; an unreachable backend yields a structured explanatory error, never an exception.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
levelNoOptional. Return only entries at this severity. Default: all levels.
limitNoOptional. Maximum number of log entries to return (most recent first). Default: 100. Ignored when `aggregate` is set.
queryNoOptional. Filter expression matched against the log message; regular expressions are supported. Omit to return all entries in the window.
labelsNoOptional. Exact-match filters on backend-extracted log fields (e.g. {"method":"GET","status":"200","url":"/","environment":"prod"}). All AND'd together and compiled to LogQL label filters applied after `| json`, so structured JSON fields become first-class selectors — far more reliable than regex on the raw message. Combine with `aggregate` to filter then group. Backends without label extraction ignore it.
serviceNoRequired (unless `raw_query` is set). Exact, case-sensitive service name exactly as returned by `list_services` (e.g. 'payment-service').
durationNoOptional. Look-back window ending at 'now', written as <number><unit> with unit s|m|h|d (e.g. '5m', '1h', '24h'). Default: '5m'.
aggregateNoOptional. Server-side aggregation pushed down to LogQL metric queries — returns grouped counts, not raw rows, so you get a number instead of a haystack (and never hit `limit`). Honours `labels`/`query` filters. Example: {"op":"topk","by":["url"],"k":10} for the busiest paths; {"op":"count_over_time","step":"15m"} for a request-count time series.
raw_queryNoOptional escape hatch: a verbatim LogQL log query, run as-is — for selectors/pipelines the curated params can't express. When set, `service`/`labels`/`level`/`query` are ignored and it is mutually exclusive with `aggregate` (express aggregation in the LogQL itself). DISABLED by default; the operator must enable the raw-query capability (OMCP_RAW_QUERY=on) or the call is refused. Redaction still applies to the returned log lines.
bypass_redactionNoOptional. When true, request that PII/secret redaction be skipped for this single call. The server only honours this when the calling identity is authorised to bypass — a credential listed in OMCP_KEY_BYPASS_REDACTION, or the anonymous identity when the operator set OMCP_BYPASS_REDACTION_ANON=true; otherwise the request still gets redacted output. Default: false.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed7 schema fields changedv3.3.0
    • addedInput schema / properties / aggregate
      Added value: +{
      +  "description": "Optional. Server-side aggregation pushed down to LogQL metric queries — returns grouped counts, not raw rows, so you get a number instead of a haystack (and never hit `limit`). Honours `labels`/`query` filters. Example: {\"op\":\"topk\",\"by\":[\"url\"],\"k\":10} for the busiest paths; {\"op\":\"count_over_time\",\"step\":\"15m\"} for a request-count time series.",
      +  "properties": {
      +    "by": {
      +      "description": "Label names to group by, e.g. [\"url\"] or [\"status\"]. Required for topk.",
      +      "items": {
      +        "type": "string"
      +      },
      +      "type": "array"
      +    },
      +    "k": {
      +      "description": "For topk: how many top groups to return (1-1000).",
      +      "exclusiveMinimum": 0,
      +      "maximum": 9007199254740991,
      +      "type": "integer"
      +    },
      +    "op": {
      +      "description": "count_over_time = time series of counts per `step` bucket; sum = single total per group over the window; topk = the top `k` groups by total.",
      +      "enum": [
      +        "count_over_time",
      +        "sum",
      +        "topk"
      +      ],
      +      "type": "string"
      +    },
      +    "step": {
      +      "description": "For count_over_time: bucket width as <number><unit> m|h|d (e.g. '15m'). Default auto-derived from duration.",
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "op"
      +  ],
      +  "type": "object"
      +}
    • changedInput schema / properties / bypass_redaction / description
      Previous value: -"Optional. When true, request that PII/secret redaction be skipped for this single call. The server only honours this when the calling credential was explicitly authorised via OMCP_KEY_BYPASS_REDACTION; otherwise the request still gets redacted output. Default: false."New value: +"Optional. When true, request that PII/secret redaction be skipped for this single call. The server only honours this when the calling identity is authorised to bypass — a credential listed in OMCP_KEY_BYPASS_REDACTION, or the anonymous identity when the operator set OMCP_BYPASS_REDACTION_ANON=true; otherwise the request still gets redacted output. Default: false."
    • addedInput schema / properties / labels
      Added value: +{
      +  "additionalProperties": {
      +    "type": "string"
      +  },
      +  "description": "Optional. Exact-match filters on backend-extracted log fields (e.g. {\"method\":\"GET\",\"status\":\"200\",\"url\":\"/\",\"environment\":\"prod\"}). All AND'd together and compiled to LogQL label filters applied after `| json`, so structured JSON fields become first-class selectors — far more reliable than regex on the raw message. Combine with `aggregate` to filter then group. Backends without label extraction ignore it.",
      +  "propertyNames": {
      +    "type": "string"
      +  },
      +  "type": "object"
      +}
    • changedInput schema / properties / limit / description
      Previous value: -"Optional. Maximum number of log entries to return (most recent first). Default: 100."New value: +"Optional. Maximum number of log entries to return (most recent first). Default: 100. Ignored when `aggregate` is set."
    • addedInput schema / properties / raw_query
      Added value: +{
      +  "description": "Optional escape hatch: a verbatim LogQL log query, run as-is — for selectors/pipelines the curated params can't express. When set, `service`/`labels`/`level`/`query` are ignored and it is mutually exclusive with `aggregate` (express aggregation in the LogQL itself). DISABLED by default; the operator must enable the raw-query capability (OMCP_RAW_QUERY=on) or the call is refused. Redaction still applies to the returned log lines.",
      +  "type": "string"
      +}
    • changedInput schema / properties / service / description
      Previous value: -"Required. Exact, case-sensitive service name exactly as returned by `list_services` (e.g. 'payment-service')."New value: +"Required (unless `raw_query` is set). Exact, case-sensitive service name exactly as returned by `list_services` (e.g. 'payment-service')."
    • removedInput schema / required
      Removed value: -[
      -  "service"
      -]
  2. Changed1 schema field changedv1.8.1
    • addedInput schema / properties / bypass_redaction
      Added value: +{
      +  "description": "Optional. When true, request that PII/secret redaction be skipped for this single call. The server only honours this when the calling credential was explicitly authorised via OMCP_KEY_BYPASS_REDACTION; otherwise the request still gets redacted output. Default: false.",
      +  "type": "boolean"
      +}
  3. Addedv1.7.2
  4. Removedv1.7.1
  5. Changed9 schema fields changedv0.1.1
    • changedInput schema / properties / duration / description
      Previous value: -"Time range (e.g. '5m', '1h', '24h'). Default: '5m'"New value: +"Optional. Look-back window ending at 'now', written as <number><unit> with unit s|m|h|d (e.g. '5m', '1h', '24h'). Default: '5m'."
    • changedInput schema / properties / level / description
      Previous value: -"Filter by log level: 'error', 'warn', 'info', 'debug'"New value: +"Optional. Return only entries at this severity. Default: all levels."
    • addedInput schema / properties / level / enum
      Added value: +[
      +  "error",
      +  "warn",
      +  "info",
      +  "debug"
      +]
    • changedInput schema / properties / limit / description
      Previous value: -"Maximum log entries to return. Default: 100"New value: +"Optional. Maximum number of log entries to return (most recent first). Default: 100."
    • addedInput schema / properties / limit / exclusiveMinimum
      Added value: +0
    • addedInput schema / properties / limit / maximum
      Added value: +9007199254740991
    • changedInput schema / properties / limit / type
      Previous value: -"number"New value: +"integer"
    • changedInput schema / properties / query / description
      Previous value: -"Optional search query to filter log messages (regex supported)"New value: +"Optional. Filter expression matched against the log message; regular expressions are supported. Omit to return all entries in the window."
    • changedInput schema / properties / service / description
      Previous value: -"Service name (e.g. 'payment-service')"New value: +"Required. Exact, case-sensitive service name exactly as returned by `list_services` (e.g. 'payment-service')."
  6. First observedv0.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate read-only, no side effects, which the description confirms and adds details like error handling (no matches yields zeroed summary, unreachable backend yields structured error). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear sections (purpose, usage, golden rule, prerequisites, behavior, returns). Slightly long but every sentence adds value; could be tightened slightly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers return format, error scenarios, redaction behavior, and prerequisites. Given 9 parameters, nested objects, and no output schema, the description provides sufficient context for correct usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed descriptions. The description adds high-level guidance (e.g., 'aggregate' to get numbers, context limit warning), but much is already in schema. The added value is marginal but present.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches recent log entries for ONE service with a pre-computed summary. It distinguishes from siblings like query_metrics and query_traces by specifying log-specific behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (inspect logs, investigate anomalies) and when not to use (metrics use query_metrics). Provides prerequisite (get service name from list_services) and a 'golden rule' for efficient usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ThoTischner/observability-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server