ssh_log_search
Read-only
Search remote server log files by regex, returning matching lines and file paths. Handles unreadable files separately and can search inside containers by name.
Instructions
Greps log files on the server and returns the matching lines with their paths, or the paths alone when line bodies are not wanted. An empty answer means no match, never a failed search — files that could not be read are listed apart. For the tail of a file rather than a search through it, ssh_log_tail is cheaper. A container is searched by name instead of by path.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Which end maxMatches keeps: "end" newest (scans the whole file), "start" oldest (stops reading at the cap). Default: end | end |
| path | No | One path, a list, or a glob in the file name: "/var/log/*.log". Expanded by the server's find, not a shell — a name with a space or a newline stays one name. A glob in the directory part is refused. | |
| sudo | No | Read as root. Straight away for places a plain user cannot read (/root, /var/lib/docker); otherwise retry with true when the answer names what it could not read. Default: false | |
| query | Yes | Regex, grep -E dialect. | |
| since | No | Window: "today" | "2026-08-19" | "2h" | "3d", the day taken from the server. Skips files untouched in it (count reported). A window of a day or more then keeps only lines dated inside — 2026-08-19, Aug 19, 19/Aug/2026; a shorter one filters files and leaves their lines alone. Undated file: searched whole and named. | |
| context | No | Lines around each match, as grep -C. Excluded by namesOnly. Default: 0 | |
| profile | Yes | Machine name. | |
| timeout | No | Milliseconds per file, default 30000. Raise for multi-gigabyte files with from: "end". | |
| container | No | Read this container's output instead of a file: docker is asked where it writes, and the answer names the file it read. Whatever cannot be read this way — a driver that keeps no file, an engine that is not docker, a name nothing answers to — comes back said aloud, naming ssh_exec as the way through. The file belongs to root, so sudo: true. Give this or path, never both. | |
| namesOnly | No | Answer = matching paths, no line bodies. One command for the whole list; maxMatches and context do not apply. Default: false | |
| recursive | No | Walk the whole tree, not one level. With a glob: "/etc/nginx/*.conf" reaches those at any depth. Symlinked files are searched, symlinked dirs not descended. Default: false | |
| maxMatches | No | Cap per file; reaching it is reported. Default: 200 | |
| caseSensitive | No | false = case ignored. Default: false |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Matching file names, for namesOnly. | |
| lines | No | The matching lines. context:true marks a neighbour shown alongside, not a match. | |
| source | No | Named only when container was asked: the engine, the driver and the file the lines were read from. | |
| limited | No | maxMatches was reached — more exist than are shown. | |
| matches | No | Lines in the answer — matches plus any context lines; with namesOnly, matching files. | |
| truncated | No | Output was cut mid-answer: incomplete, not empty. | |
| files_skipped | No | Left unread by the since window. | |
| files_undated | No | No recognisable timestamp: searched whole, the window was not applied. | |
| files_searched | No | ||
| files_unreadable | No | Opened with an error — not proof the text is absent. |