Menü
Log management - search logs with CQL, log volume graphs, schema discovery.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
| name | ed-logs |
| description | Log management - search logs with CQL, log volume graphs, schema discovery. |
| metadata | {"version":"1.0.0","author":"edgedelta","repository":"https://github.com/edgedelta/agent-skills","tags":"edgedelta,logs,logging,search,cql","globs":"**/edgedelta*.yaml,**/*log*","alwaysApply":"false"} |
Search and aggregate logs with CQL (Common Query Language).
The edx CLI must be installed and authenticated. See the ed-edx skill.
edx facets keys --scope log, then edx facets options --scope log --facet <field>.# Basic error search
edx logs search -q 'severity_text:"ERROR"' --lookback 1h
# Scoped to a service, more results
edx logs search -q 'service.name:"api" AND severity_text:"ERROR"' --lookback 1h --limit 100
# Absolute time window (incident windows from PagerDuty etc.)
edx logs search -q 'error' --from 2026-06-12T00:00:00.000Z --to 2026-06-12T01:00:00.000Z
# Human-readable table
edx logs search -q 'error' --output table --columns timestamp,severity_text,service.name,body
| Query | Meaning |
|---|---|
error timeout | Full-text search (bare words) |
severity_text:"ERROR" | Field equals |
service.name:("api" OR "web") | Multiple values |
-severity_text:"DEBUG" | Negation |
@response.code > 400 | Numeric attribute comparison |
@Record.errorCode:"AccessDenied" | Attribute (structured field) equals - note the leading @ |
a AND b, a OR b | Boolean operators |
Not supported: regular expressions (/pattern/), =/!= operators,
wildcards mid-string.
Common fields: service.name, severity_text, host.name, ed.tag,
k8s.namespace.name, k8s.pod.name, body.
Full-text search (bare words) only matches body. Structured logs often keep
the interesting value in an attribute, not the body - e.g. a CloudTrail
record has body: "AssumeRole" (just the event name) while the failure lives in
the Record.errorCode attribute. Query attributes with a leading @
(@Record.errorCode:"AccessDenied"); the same field without the @ matches
nothing. So if a full-text search returns zero, the value is probably in an
attribute - inspect one raw record to find the real field names, then filter:
edx logs search -q 'service.name:"<svc>"' --limit 1 --output raw # read the attributes map
edx logs search -q 'service.name:"<svc>" AND @Record.errorCode:"AccessDenied"'
Aggregate log counts over time (find spikes, compare services):
# Error volume per service
edx logs graph -q 'severity_text:"ERROR"' --group-by service.name --lookback 6h
# Total volume for one service
edx logs graph -q 'service.name:"api"' --lookback 24h
Responses include cursors. Continue a search:
edx logs search -q 'error' --limit 100 --cursor "<next_cursor from previous response>"
--lookback 24h.edx facets options --scope log --facet service.name.body.
Inspect a raw record (--limit 1 --output raw) and query it with @field:"value".AI Teammate - manage connectors (PagerDuty, Slack, GitHub, ...), update teammates (agents) and view teammate activity.
Pipelines - fleet management, config changes, version history, deployments and live capture.
Dashboards - create, update, inspect and validate metric dashboards from the CLI.
Cross-signal incident investigation workflow - from alert to root cause using events, patterns, logs, metrics, traces and pipeline history.
Metrics - discover metric names and run aggregation queries (timeseries and tables).
Monitors - create, manage, snooze and resolve Edge Delta monitors and alerts.