Logpresso Store

User Guide

With the MCP server installed, an AI client such as Claude can query your logs in plain language. You do not need to know the query syntax: the AI finds which schema holds the data, checks field types, writes a query, validates it and runs it.

Every access is recorded in the audit log, and running queries can be stopped from the screen.

What to Ask

Example question	What the AI does
Top 20 blocked IPs on the firewall yesterday	Finds the firewall schema and runs an aggregate query
Where does the address 52.202.233.37 appear	Searches everything through the index
Break this week's tickets down by status	Reads the ticket data
Any accounts with many failed logins yesterday	Reads authentication logs and judges what stands out
Check whether this query is valid	Validation only; reads no log data

Naming a time range narrows the search and makes the answer faster. If you do not name one the AI picks its own, so always give a range when looking for older data.

Note

The AI queries only with the permissions of the account whose API key it connected with. A table that account cannot read is a table the AI cannot read either, and an unauthorised query is refused at the validation step.

Tools the AI Uses

The AI works through the tools below. These names appear verbatim in the audit log, which is where you check who did what.

Tool	What it does	Reads log data
`logpresso_find_datasource`	Finds which schema or table holds the data	No
`logpresso_describe_datasource`	Checks field names and types	Only when sampling
`logpresso_lookup_reference`	Looks up query command and function syntax	No
`logpresso_list_objects`	Lists configured objects - parsers, lookups, groups	No
`logpresso_validate_query`	Validates a query before it runs	No
`logpresso_run_query`	Runs a query	Yes
`logpresso_fetch_result`	Fetches more of a running query's result	Yes
`logpresso_cancel_query`	Stops a run and releases its result	No

Only two of them read logs: logpresso_run_query and logpresso_fetch_result. The rest read schema and syntax only, so no data is exposed through them.

Reviewing Access

The Logs tab records every request that reached the MCP endpoint - account, source IP, tool used, status, elapsed time, request and response sizes - filterable by period and condition.

Click a row to see what was actually exchanged. The query that was run is preserved verbatim in the request body.

Note

Query result rows are not stored in the audit log. The query itself is already recorded, so keeping the rows as well would add no audit value while raising sensitivity.

A non-administrator sees only their own requests.

Managing Running Queries

The Queries tab collects the live query runs from every node. It shows which account is running which query, how long it has been going and how many rows it has produced.

A run that is taking too long, or whose scope is clearly too wide, can be stopped with the Stop button. For a run that already finished, Release frees its result.

Click a row to see the rows fetched so far. That screen does not extend the run's lifetime, so a run the AI already cancelled - or one left idle - may be released while you are looking at it. In that case only the rows already fetched remain on screen.

Limits Worth Knowing

Item	Value	What it means
Result per call	200 rows or 10,000 characters	The AI aggregates instead of listing raw rows
Rows one run may return	20,000	Beyond that, the question needs an aggregate query
Concurrent runs per account	4	A new query waits for an earlier one to finish
Run idle timeout	30 minutes	The result is released if the AI stops reading it
Maximum run duration	15 minutes	Past that the run is cancelled and partial rows remain

The cost of a query is the volume searched, not the rows returned. A query over a wide time range searches all of it even when it returns nothing, so it takes just as long.

Common Problems

Symptom	What to check
The AI cannot connect to Logpresso	The verification steps in the install guide, and whether the client was restarted
It reports no results where data exists	The time range. Ask again with an explicit range
One particular table never returns anything	The table read permission of the API key's account
Queries are consistently slow	The scope of the runs in the `Queries` tab; stop them if needed
The answer looks cut off	The 200-row cap per call. Ask for an aggregate or a top-N