[READ] List defined Log Insight alerts.

Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {id, name, enabled, info}. Start here, then pass an id to alert_get or alert_history. total is the real count matching name_filter, so truncated answers whether more exist; raise limit or narrow name_filter when true. Read-only — this skill never creates/edits/deletes alerts.

[READ] Get the stored definition of one alert. Use this after alert_list.

Returns the same sanitized {id, name, enabled, info} projection as an alert_list row plus 'raw_keys' — the sorted key names the appliance actually sent — so you can see what else the definition carries without this skill guessing at its shape. For when the alert fired, use alert_history. Read-only.

[READ] List recent trigger-history records for an alert.

Use this for when an alert fired, not how it's defined. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {timestamp_ms, info}. total is the real history-record count, so truncated answers whether older records were left behind — raise limit when true. Read-only.

[READ] Search Log Insight events within a time window.

WHEN: to find the actual log lines behind an incident (e.g. what vmkernel logged during a storage event). For "where did logs burst?" use log_aggregate instead; for vCenter alarms use vmware-monitor.

RETURNS: {count, complete (False if truncated), constraints, events: [{timestamp_ms, text, fields}]}. Feed events to vmware-debug incident_timeline to correlate across sources. Read-only.

[READ] Aggregate matching events into a time series and detect spikes.

WHEN: to find when/whether log volume burst without pulling raw events. Follow up with log_search on the spike window.

RETURNS: {aggregation, bin_width_ms, constraints, bins:[{timestamp_ms, value}], spikes:[{timestamp_ms, value, zscore}]}. A bin is flagged as a spike when it sits at least 2 standard deviations above the mean; a series of fewer than 3 bins, or a flat one, reports no spikes rather than calling everything a spike — so an empty 'spikes' list is not evidence of calm when the window is short. Read-only.

[READ] List the extracted fields available to use in query filters.

Use this to discover valid field names before filtering log_search / log_aggregate. Returns the family list envelope {items, returned, limit, total, truncated, hint}; each item is {name}. No limit — every matching field is returned, so truncated is always false: this is the complete field list, not a page. Read-only.

[READ] Return the Log Insight appliance version/build (diagnostics and query-syntax compatibility). Returns {version, release_name, build}. Use this first when a query behaves unexpectedly, to confirm the appliance version before trusting log_search. Read-only.