Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fmcp-server%2Ftools%2Flogs-and-traces.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fmcp-server%2Ftools%2Flogs-and-traces.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Logs and traces

Using the `query_dataprime` tool, you may query **logs**, **spans**, and **cases** in the [Compliance (archive) pipeline](https://coralogix.com/docs/docs/user-guides/account-management/tco-optimizer/.md#features-by-priority-level) using [DataPrime](https://coralogix.com/docs/docs/dataprime/introduction/welcome-to-the-dataprime-reference/.md), Coralogix’s powerful query syntax language. Set the source in your query—`source logs`, `source spans`, or a cases dataset—to select what to query. This tool allows AI agents to investigate production issues, filter errors, and analyze trace behavior using structured observability data.

If your query fails, you will receive a message describing how to fix and rerun it.

For example, using Cursor, you may input:

```
Show me up to 50 error logs from the payment-service application on January 15, 2024.
```

Your agent will produce a query similar to the following:

```
{

"query": "source logs | filter $l.applicationname == 'payment-service' | filter $m.severity == ERROR | limit 50",

"start_date": "2024-01-15T00:00:00Z",

"end_date": "2024-01-15T23:59:59Z"

}
```

Or, for example, using Cursor, you may input:

```
Find up to 20 spans where the HTTP status code was 500 or higher.
```

Your agent will produce a query similar to the following:

```
{

  "query": "source spans | filter $d.http.status_code >= 500 | limit 20"

}
```

### Query parameters[​](#query-parameters "Direct link to Query parameters")

The following parameters are available for querying logs and traces.

| Name         | Description                                                                                                                                              |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `query`      | A DataPrime query to fetch logs or spans, using `source logs` or `source spans` and a series of filter/aggregate steps.                                  |
| `start_date` | Start of the time range in ISO 8601 format. Defaults to 15 minutes before `end_date`. Allows dates up to three months back from the current date.        |
| `end_date`   | End of the time range in ISO 8601 format. Defaults to now, or 15 minutes after `start_date`. Allows dates up to three months back from the current date. |
| `limit`      | Maximum number of results to return (default: 20). This is a top-level tool parameter, separate from any `limit` step inside the `query`.                |

### Common use-cases[​](#common-use-cases "Direct link to Common use-cases")

Here are some common use-cases for the server to get you started:

* Search for common errors and fix them in your code from Cursor
* Find anomalies in logs using existing agents such as Cursor or Claude Desktop
* [Accessing fields with special characters](https://coralogix.com/docs/docs/dataprime/cookbook/accessing_special_chars/.md)
* [Conditionally count logs](https://coralogix.com/docs/docs/dataprime/cookbook/conditionally_count/.md)
* [Count k8s container restarts](https://coralogix.com/docs/docs/dataprime/cookbook/container_restart/.md)
* [Summarize container restarts](https://coralogix.com/docs/docs/dataprime/cookbook/counting_container_restarts/.md)
* [Find peak traffic](https://coralogix.com/docs/docs/dataprime/cookbook/peak_traffic/.md)
* [Parsing date strings](https://coralogix.com/docs/docs/dataprime/cookbook/parsing_timestamps/.md)
* [Create variables for timestamp calculations](https://coralogix.com/docs/docs/dataprime/cookbook/timestamp_variables/.md)
* [Convert a timestamp](https://coralogix.com/docs/docs/dataprime/cookbook/convert_timestamp/.md)
* [Fuzzy search all fields](https://coralogix.com/docs/docs/dataprime/cookbook/fuzzy_search_all_fields/.md)
* [Count and sort events](https://coralogix.com/docs/docs/dataprime/cookbook/count_and_sort/.md)
* [Bucket longtask durations into performance ranges](https://coralogix.com/docs/docs/dataprime/cookbook/bucket_longtask/.md)
* [Calculate Lambda invocation duration](https://coralogix.com/docs/docs/dataprime/cookbook/lambda_invocation/.md)

## Service dependency graph[​](#service-dependency-graph "Direct link to Service dependency graph")

Use the `get_service_map_relations_graph` tool to get a graph of how your services interact, derived from Coralogix tracing data for a time range. Use it to understand service dependencies before drilling into a specific service's logs or spans.

* Omit `service_name` to get a compact full service-map graph as an adjacency map.
* Pass a `service_name` to get only the services interacting with it, including node and edge details.

| Name           | Required | Type   | Description                                                                                      |
| -------------- | -------- | ------ | ------------------------------------------------------------------------------------------------ |
| `time_range`   | No       | object | A time range with `start_time` and `end_time` in ISO 8601 UTC format. Defaults to the last hour. |
| `service_name` | No       | string | Focus the graph on one service. Omit for the full service map.                                   |

## Next steps[​](#next-steps "Direct link to Next steps")

Query Prometheus-compatible time-series data with [Metrics](https://coralogix.com/docs/docs/user-guides/mcp-server/tools/metrics/.md).