How do I ask an AI agent for recent lines from OpenTelemetry log records?

Tares lets you connect an MCP client and ask what happened to a service in the last 15 minutes, and the agent answers from the correlated timeline that includes your OpenTelemetry log lines. The agent calls the read tool, which returns logs, metrics, alerts and findings in one time-ordered read. You need an otlp source receiving your logs and a client connected to the Tares MCP endpoint.

How it works

The otlp connector receives OTLP/HTTP logs, traces and metrics at POST /v1/{logs,traces,metrics}. One source ingests every service. Resource attributes such as service.name become labels, so everything your SDK or Collector exports correlates by service with no per-service setup.

When you ask your agent a question like “what happened to api-server in the last 15 minutes?”, it calls read. That tool returns a correlated, time-ordered timeline across all sources that match a {label: value} selector, so the log lines sit next to metrics, alerts and findings for the same service.

A label reads its value by path from the event:

• resourceAttributes.<key> for resource attributes, such as resourceAttributes.service.name.
• attributes.<key> for the attributes of a log record, span or data point.
• text for the rendered log line.

There is no bare service field, so a label with field: service gets no value from an OTLP event.

Set it up

1. Create the otlp source. Ask a connected agent, “Use tares to create an OTLP source keyed by service.” The agent calls create_source. You can also use Sources → Add source → otlp in the console and save this config:

   - name: otel
     connector: otlp
     config:
       labels:
         - { name: service, field: resourceAttributes.service.name, primary: true }

2. Point your exporter at the daemon. For gRPC, install the otlp-grpc extra first. The receiver then listens on :4317.

   OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:8787   # OTLP/HTTP → /v1/{logs,traces,metrics}
   # or gRPC (otlp-grpc extra): OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

   On a secured instance, the exporter sends an ingest-scoped API key in an Authorization: Bearer header. It is needed only when Tares has auth on.

3. Start the MCP server if Tares runs on your machine. The daemon alone does not serve /mcp. On a server or Tares Cloud instance the MCP server is already running.

   tares mcp --transport streamable-http --port 8788 --taresd http://localhost:8787

4. Connect your client. For Claude Code, run this in your terminal:

   claude mcp add --transport http tares http://localhost:8788/mcp

   Codex, Cursor and any other MCP client connect to the same endpoint. The Connecting agents (MCP) page has the exact snippet for each client. On Tares Cloud, the console’s Connect page shows the endpoint and token for your instance. On a secured instance, use a read-scoped API key.

5. Ask your question:

   Use tares: what happened to api-server in the last 15 minutes?

   Replace api-server with the value of your service label. To check the connection first, ask “Use tares: what are you ingesting right now?” The client calls catalog_list and lists your sources.

For the exporter and label details, see the OpenTelemetry connector page. This setup belongs to the AI SRE workflow.

What you get

• One answer that combines the log lines with metrics, alerts and findings for the service, ordered by time.
• A natural-language question that replaces a hand-written log query.
• Every service your exporter sends is available under the service key, with no per-service setup.
• A record of each read. In the console, Reads lists them as they happen, tagged client = mcp.
• To check that logs are arriving, Recent events shows spans, logs and metric points as they land, and Explore lists services under the service key.

When something else fits

• If you only want to browse data yourself without an external client, use Ask in the console. It is a chat loop inside Tares with the same read tools, opened under Ask or with ⌘K.
• If you want to be woken when a pattern appears rather than ask after the fact, have the agent call create_trigger over the otlp source.

Related