| name | elasticsearch-logs |
| description | Search and analyse logs in an existing Elasticsearch cluster (8.x/9.x) — syslog, application logs, Zeek/Suricata exports, or any indexed event data. Use for "what errors did we see", "how many times did X happen", "show me logs from device Y", "which host logged the most". Read-only. Counting questions MUST go through ESQL or track_total_hits — a bare search total silently caps at 10,000. |
Elasticsearch Logs
Read-only log search over an Elasticsearch cluster you already run. NetClaw installs no
cluster and indexes nothing — this queries what is already there.
Server: elasticsearch-mcp (adopted, docker.elastic.co/mcp/elasticsearch, Apache-2.0,
digest-pinned) · 5 tools · 1,094 tokens
The rule that matters most
A bare search total is capped at 10,000 and reads as if it were exact.
Elasticsearch stops counting at 10,000 and marks the total relation: "gte" — meaning at
least. This server discards that qualifier and prints Total results: 10000. There is
nothing in the response to tell you the number is a floor.
Measured against 10,075 real documents:
| How you ask | What you get |
|---|
search with no guard | Total results: 10000 — wrong |
search with "track_total_hits": true | Total results: 10075 — correct |
esql STATS COUNT(*) | 10075 — correct |
On a million-document index a bare search still says 10,000.
