Graylog MCP Server

Aggregate matching messages by the top values of a field instead of returning raw lines. Optionally add a time histogram of match volume. Three main uses: (1) WHAT IS FAILING — aggregate on a message field (`msg`, or whatever short summary field list_fields reveals) to collapse a thousand repetitions of one error into one row with a count; on `name`/`container_name`/`source` to see who is emitting them. This is far cheaper and more informative than reading the same lines via search. (2) WHEN — set histogramInterval to see whether volume spiked. (3) DISCOVER A VALUE you are about to filter on — set `valueContains` to find the real name of a namespace/pod/service rather than guessing it (Elasticsearch rejects a leading wildcard, so `field:*foo*` is an error and this is the only way to substring-match a value). Pass streams:"*" to aggregate across every readable stream in one request — cheap here, and the reliable way to see a service whose stream removes its matches from the Default Stream.

Fetch the full, untruncated document for a single message by its _id and _index (both returned by search). Use after a concise search to inspect one hit in full.

List the message fields that actually exist in the index. Use this BEFORE searching on a field you have not seen in a result, so you never guess a field name — a query on a nonexistent field returns 0 matches, which is indistinguishable from 'no logs'. Clusters index thousands of fields, so pass `contains` to narrow (e.g. "namespace").

List the Graylog streams the API token can read (id + title, and whether each removes its matches from the Default Stream). To search everything, pass streams:"*" to search/analyze rather than listing streams here. A cluster can hold thousands of streams, so results are capped — use `titleContains` to find one specific named stream (e.g. a service whose logs are absent from the Default Stream).

Read individual matching log lines across one or more streams, merged newest-first. Returns a concise projection of high-signal fields by default (set verbose:true for all fields). Raw lines are expensive: if you want to know WHAT is failing rather than read specific lines, use analyze first — a hundred repetitions of one error cost a hundred times as much here as one aggregated count. Pass streams:"*" to cover every readable stream when you do not know which stream a service logs to (the Default Stream often excludes it).