observe_logs_search

Tool

observe_logs_search

Search the log lines of the current product, newest first.

Search the log lines of the current product, newest first. Reads the last 24 hours unless from/to say otherwise, and answers windows of up to 7 days — wider when a traceId or a single-word search pins the read to an index. Filters are structured; there is no SQL surface. Page with nextCursor.

Behavior

HTTP: GET /observe/logs/search

Arguments

Name	Type	Required	Description
q	string	—	Lucene-style expression, ANDed with the structured filters. `key:value` (service, environment, severity, trace_id, span_id, body; any other key matches an attribute), "quoted phrases", AND / OR / NOT in uppercase, parentheses. A bare word matches a whole word in the message body. Example: service:api AND NOT severity:INFO AND "connection refused"
to	string	—	Newest timestamp to include, ISO 8601. Defaults to now
from	string	—	Oldest timestamp to include, ISO 8601. Defaults to 24 hours before `to`. A window longer than 7 days is rejected unless the read is answered by an index — a `traceId`, or a single-word `search`/body term in `q` — in which case it may reach back to the edge of this product’s retention, and does so by default
limit	integer	—	How many lines to return, 1-1000, default 100
cursor	string	—	The nextCursor of the previous page; omit for the first page
search	string	—	Match the message body. A single word matches whole words and is indexed; anything longer is a case-insensitive substring match
service	string	—	Only lines of this service, e.g. "api"
traceId	string	—	Only lines of this trace
severityIn	array	—	Only lines whose severity is one of these, e.g. ["ERROR", "FATAL"]
environment	string	—	Only lines of this environment, e.g. "production"

Response

Field	Type	Always	Description
rows	array	•	The matching log lines, newest first
nextCursor	string	•	Pass back as cursor for the next page; null when the last page was reached

Try it

Search the log lines of the current product, newest first.

When to use

Example

Ask your agent something like this:

Search the log lines of the current product, newest first.

The agent will invoke observe_logs_search with these arguments:

{}