query-logs

Query Lensflare telemetry

You have access to a structured query language exposed via lensflare:queryTelemetry. The full grammar is in that tool's description — read it. Examples:

• "errors from the api service" → serviceName = "api" and (level in ["error", "fatal"] or status = "error")
• "slow requests" → durationUs >= 1000000
• "anything that mentions ECONNRESET" → message ~= /ECONNRESET/
• "logs with http status 500" → attributes.http.status_code = 500

Steps:

1. Identify the dataset. Use lensflare:listDatasets if needed.
2. Translate the user's prose into a single query string. Prefer structured comparisons over free-text — fewer false positives, easier to refine.
3. Call lensflare:queryTelemetry with limit: 50 (or as requested). Use cursor from usage.nextPageCursor if the user asks for more.
4. Summarise the page: counts, time range covered, dominant serviceName / level. Show a few example records inline (id, level, message or name, timestamp).
5. Offer a refined query if the result set is too broad or too narrow.

Never invent fields — call queryTelemetry with no query first if you're unsure; the records show you the available shape.