loggly-mcp

MCP server and CLI for searching and exploring Loggly logs.

Setup

npm install -g loggly-mcp

Set your credentials as environment variables:

export LOGGLY_API_TOKEN=your-token
export LOGGLY_SUBDOMAIN=your-subdomain

MCP Server

Add to your Claude Code, Cursor, or other MCP client config:

{
  "mcpServers": {
    "loggly": {
      "command": "loggly-mcp",
      "env": {
        "LOGGLY_API_TOKEN": "your-token",
        "LOGGLY_SUBDOMAIN": "your-subdomain"
      }
    }
  }
}

Or with npx (no install needed):

{
  "mcpServers": {
    "loggly": {
      "command": "npx",
      "args": ["-y", "loggly-mcp"],
      "env": {
        "LOGGLY_API_TOKEN": "your-token",
        "LOGGLY_SUBDOMAIN": "your-subdomain"
      }
    }
  }
}

Available Tools

| Tool | Description | |------|-------------| | search-logs | Search logs with Loggly query syntax, time range, size, and sort order | | get-fields | List available log fields and their cardinality | | get-field-values | Get top values for a specific field |

CLI

# Search logs
loggly-cli search "syslog.severity:error" --from -1h --size 20

# List available fields
loggly-cli fields

# Get top values for a field
loggly-cli field-values syslog.severity

# Raw JSON output
loggly-cli search "status:500" --json

CLI Options

--from, -f <time>       Start time (e.g. -1h, -24h)    [default: -24h]
--until, -u <time>      End time (e.g. now)             [default: now]
--size, -s <n>          Number of results (max 1000)    [default: 50]
--order, -o <asc|desc>  Sort order by timestamp         [default: desc]
--json                  Output raw JSON
--help, -h              Show help

Docker

docker build -t loggly-mcp .
docker run -i -e LOGGLY_API_TOKEN=xxx -e LOGGLY_SUBDOMAIN=yyy loggly-mcp

License

MIT