Skip to Content
Tares

How do I ask an AI agent for recent lines from Grafana Loki logs?

Tares lets you ask an AI agent for recent Loki log lines by connecting the agent over MCP and asking what happened to a service in the last 15 minutes. The agent calls the read tool, which returns a correlated, time-ordered timeline that includes the Loki log lines next to your other sources. This works with Claude Code, Codex, Cursor or any MCP client. It also works with Grafana Cloud as the Loki upstream.

How it works

The loki connector polls a Loki instance with a LogQL query you choose and stores the matching log lines as events in Tares. It polls every 5 seconds by default, and it covers Grafana Cloud as well as a self-hosted Loki.

Your agent connects to the Tares MCP endpoint and discovers the Tares tools. When you ask a question about a service, the agent calls read. read returns one timeline across all sources that match a label and value selector, using strict AND. The timeline mixes logs, metrics, alerts and findings, so the Loki lines show up in order alongside everything else that happened to that service. Pass project or sources to narrow the read, for example to the Loki source alone.

The source accepts these settings:

  • url and query: the Loki address and the LogQL selection.
  • bearer_token, or username and password: credentials for the Loki upstream.
  • tenant_id: the tenant for a multi-tenant Loki.
  • match and drop: keep or discard lines.
  • key: the entity the lines belong to.

Give the source a label that carries the service name. That is what lets a question about one service pull its Loki lines into the same timeline as its other data.

Set it up

  1. Add a source with the connector loki. Set url to your Loki or Grafana Cloud address and query to the LogQL that selects the service’s logs. Add bearer_token, or username and password, and tenant_id if your Loki needs them. Give the source a label for the service so the selector can match it.

  2. Start Tares locally and, in a second terminal, start the MCP server. The daemon alone does not serve the MCP endpoint.

    tares up
tares mcp --transport streamable-http --port 8788 --taresd http://localhost:8787

    The endpoint is then http://localhost:8788/mcp. On your own server it is https://<your-domain>/mcp. On Tares Cloud it is shown under Connect in your console, and nothing needs starting.

  3. Connect your client. For Claude Code:

    claude mcp add --transport http tares http://localhost:8788/mcp

    Codex, Cursor and other MCP clients connect with the same endpoint. See Connecting agents (MCP) for each client’s command or config file. On a secured instance, the client sends an Authorization: Bearer header holding an API key with the read scope.

  4. Verify the connection by asking your client:

    Use tares: what are you ingesting right now?

    The client calls catalog_list and answers with your sources, triggers and projects. Your Loki source should be in that list.

  5. Ask for the recent lines:

    Use tares: what happened to api-server in the last 15 minutes?

    The agent calls read for that service and answers from the timeline, with the Loki log lines included. Replace api-server with the service name from your label. In the console, Reads lists each read as it happens, tagged client = mcp.

For a deeper look at how SRE work fits together in Tares, start from AI SRE.

What you get

  • Recent Loki log lines in one answer, ordered in time with the metrics, alerts and findings for the same service.
  • Plain-language questions. You name the service and the window, and the agent builds the read.
  • One connection for many clients. Claude Code, Codex, Cursor and other MCP clients all use the same endpoint and tools.
  • A visible trail. Each read appears in the console under Reads.
  • Narrower reads when you want them. The agent can restrict read to the Loki source, or use catalog_describe to see that source’s schema, freshness and sample events.

When something else fits

  • If you only want to browse raw Loki logs with your own LogQL, Grafana’s own tools are the direct route. Tares is the better fit when you want logs correlated with other signals.
  • If you want a person or agent to be woken when a log pattern appears, create a trigger over the Loki source instead of asking by hand. The create_trigger tool does this.
  • If you prefer not to connect an outside client, use Ask in the console. It is the same idea hosted inside Tares, and it opens with ⌘K. See Connecting agents (MCP) for how it relates to external clients.

Still stuck? Get help

Last updated on
Quickstart