# Logs and traces

Using the `get_logs_v1` and `get_traces_v1` tools, you may query **logs** and **spans** in the [Compliance (archive) pipeline](https://coralogix.com/docs/user-guides/account-management/tco-optimizer/#features-by-priority-level) using [DataPrime](https://coralogix.com/docs/dataprime/introduction/welcome-to-the-dataprime-reference/), Coralogix’s powerful query syntax language. These tools allow AI agents to investigate production issues, filter errors, and analyze trace behavior using structured observability data.

If your query fails, you will receive a message describing how to fix and rerun it.

For example, using Cursor, you may input:

```js
Show me up to 50 error logs from the payment-service application on January 15, 2024.
```

Your agent will produce a query similar to the following:

```js
{
"query": "source logs | filter $l.applicationname == 'payment-service' | filter $m.severity == ERROR | limit 50",
"startDate": "2024-01-15T00:00:00Z",
"endDate": "2024-01-15T23:59:59Z"
}
```

Or, for example, using Cursor, you may input:

```js
Find up to 20 spans where the HTTP status code was 500 or higher.
```

Your agent will produce a query similar to the following:

```js
{
  "query": "source spans | filter $d.http.status_code >= 500 | limit 20"
}
```

### Logs & traces parameters

The following parameters are available for querying logs and traces.

| Name        | Description                                                                                                                                                       |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `query`     | A Dataprime query to fetch logs or spans, using `source logs` or `source spans` and a series of filter/aggregate steps.                                           |
| `limit`     | Maximum number of results to return (default: 20).                                                                                                                |
| `startDate` | Start of the time range in ISO 8601 format (optional; defaults to 15 minutes before `endDate`). Allows dates up to three months back from the current date.       |
| `endDate`   | End of the time range in ISO 8601 format (optional; defaults to now or 15 minutes after `startDate`). Allows dates up to three months back from the current date. |

### Common use-cases

Here are some common use-cases for the server to get you started:

- Search for common errors and fix them in your code from Cursor
- Find anomalies in logs using existing agents such as Cursor or Claude Desktop
- [Accessing fields with special characters](https://coralogix.com/docs/dataprime/cookbook/accessing_special_chars/)
- [Conditionally count logs](https://coralogix.com/docs/dataprime/cookbook/conditionally_count/)
- [Count k8s container restarts](https://coralogix.com/docs/dataprime/cookbook/container_restart/)
- [Summarize container restarts](https://coralogix.com/docs/dataprime/cookbook/counting_container_restarts/)
- [Find peak traffic](https://coralogix.com/docs/dataprime/cookbook/peak_traffic/)
- [Parsing date strings](https://coralogix.com/docs/dataprime/cookbook/parsing_timestamps/)
- [Create variables for timestamp calculations](https://coralogix.com/docs/dataprime/cookbook/timestamp_variables/)
- [Convert a timestamp](https://coralogix.com/docs/dataprime/cookbook/convert_timestamp/)
- [Fuzzy search all fields](https://coralogix.com/docs/dataprime/cookbook/fuzzy_search_all_fields/)
- [Count and sort events](https://coralogix.com/docs/dataprime/cookbook/count_and_sort/)
- [Bucket longtask durations into performance ranges](https://coralogix.com/docs/dataprime/cookbook/bucket_longtask/)
- [Calculate Lambda invocation duration](https://coralogix.com/docs/dataprime/cookbook/lambda_invocation/)

## Next steps

Query Prometheus-compatible time-series data with [Metrics](https://coralogix.com/docs/user-guides/mcp-server/tools/metrics/index.md).