MCP Server Logs Sieve

What Oluwatunmise-olat/mcp-server-logs-sieve MCP server does

Oluwatunmise-olat/mcp-server-logs-sieve MCP server connects an MCP-compatible AI assistant to a selected observability backend. It supports Google Cloud Logging, AWS CloudWatch Logs, Azure Monitor Logs, Grafana Loki, and Elasticsearch. The package is intended for natural-language investigation of operational logs, including finding relevant entries, reviewing activity over a time range, identifying recurring failures, and following a request trace.

The server works with one provider at a time. A provider such as gcp, aws, azure, loki, or elasticsearch is supplied when the process starts. Provider-specific authentication and configuration are documented separately in the repository.

How it works

The MCP interface exposes four operations:

• query_logs retrieves log entries using a provider, scope, time window, and filter.
• summarize_logs produces a summary of logs for the selected scope and period.
• trace_request follows a request using a trace identifier.
• list_log_sources reports the log sources available through the configured provider.

An assistant can use these tools to turn questions such as investigating a failed payment or examining the last day of activity into structured log operations. The same package also includes terminal commands for querying, summarizing, tracing, and listing sources without an MCP client.

Setup and configuration

Oluwatunmise-olat/mcp-server-logs-sieve MCP server requires Node.js 20 or later. A minimal MCP configuration runs the package with npx and chooses a provider:

{
  "mcpServers": {
    "logs-sieve": {
      "command": "npx",
      "args": ["-y", "mcp-server-logs-sieve@latest", "--provider", "gcp"]
    }
  }
}

The provider value should match the backend being used. Authentication is provider-specific, so the relevant setup guide must be consulted for GCP, AWS, Azure, Loki, or Elasticsearch. Elasticsearch users may also need to set ELASTICSEARCH_COMPAT_VERSION when compatibility headers are required; the README shows 8 as the example value.

On first use, npx downloads the package. The repository notes that this can take about 40 seconds and may cause a client startup timeout. Running the package once beforehand can populate the local npx cache. After changing MCP configuration, restart the client and verify that the server is available.

Tools and capabilities

The server supports five backends but does not present them as a single combined search. The selected provider determines where each operation runs. Querying accepts a provider, scope, time period, and filter; summarization accepts a provider, scope, and period; tracing accepts a provider, scope, and trace ID; and source listing accepts a provider and scope.

For direct terminal use, the package provides query, summarize, trace, and sources commands. Example workflows include querying GCP logs for a phrase over the last hour, summarizing a project’s logs for the last 24 hours, tracing a request by trace ID, and listing sources for a project.

Limitations and notes

Node.js 20 or newer is required because the package uses ES modules and dependencies that require that runtime. The README does not define one universal authentication method or a shared credential set for all providers; setup must follow the individual provider documentation. The server also operates against the provider selected at startup rather than automatically searching all five backends at once.

The documented MCP client setup covers Claude Code, Claude Desktop, Cursor, and Windsurf. The repository includes troubleshooting, compatibility, and tool-reference documentation for further provider and client details.