Logs and Traces

Using the get_logs and get_traces tools, you may query logs and spans in the Compliance (archive) pipeline using DataPrime, Coralogix’s powerful query syntax language. These tools allow AI agents to investigate production issues, filter errors, and analyze trace behavior using structured observability data.

If your query fails, you will receive a message describing how to fix and rerun it.

For example, using Cursor, you may input:

Show me up to 50 error logs from the payment-service application on January 15, 2024.

Your agent will produce a query similar to the following:

{
"query": "source logs | filter $l.applicationname == 'payment-service' | filter $m.severity == ERROR | limit 50",
"startDate": "2024-01-15T00:00:00Z",
"endDate": "2024-01-15T23:59:59Z"
}

Or, for example, using Cursor, you may input:

Find up to 20 spans where the HTTP status code was 500 or higher.

Your agent will produce a query similar to the following:

{
  "query": "source spans | filter $d.http.status_code >= 500 | limit 20"
}

Logs & traces parameters

The following parameters are available for querying logs and traces.
Name Description
query A Dataprime query to fetch logs or spans, using source logs or source spans and a series of filter/aggregate steps.
limit Maximum number of results to return (default: 20).
startDate Start of the time range in ISO 8601 format (optional; defaults to 15 minutes before endDate). Allows dates up to three months back from the current date.
endDate End of the time range in ISO 8601 format (optional; defaults to now or 15 minutes after startDate). Allows dates up to three months back from the current date.

Common use-cases

Here are some common use-cases for the server to get you started:

Search for common errors and fix them in your code from Cursor
Find anomalies in logs using existing agents such as Cursor or Claude Desktop
Accessing fields with special characters
Conditionally count logs
Count k8s container restarts
Summarize container restarts
Find peak traffic
Parsing date strings
Create variables for timestamp calculations
Convert a timestamp
Fuzzy search all fields
Count and sort events
Bucket longtask durations into performance ranges
Calculate Lambda invocation duration

Metrics

Next Reference Tools

Name	Description
`query`	A Dataprime query to fetch logs or spans, using `source logs` or `source spans` and a series of filter/aggregate steps.
`limit`	Maximum number of results to return (default: 20).
`startDate`	Start of the time range in ISO 8601 format (optional; defaults to 15 minutes before `endDate`). Allows dates up to three months back from the current date.
`endDate`	End of the time range in ISO 8601 format (optional; defaults to now or 15 minutes after `startDate`). Allows dates up to three months back from the current date.