filtering-event-datasets

Filter log datasets using OPAL with text, regex, and field-value patterns.

Updated Aug 27, 2026

Search Tags:#logs #discovery #regex #filter #datasets #OPAL

Ready to run

npx skills add https://github.com/rustomax/observe-community-mcp --skill filtering-event-datasets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: filtering-event-datasets
Source: https://github.com/rustomax/observe-community-mcp/tree/main/skills/filtering-event-datasets
Command: npx skills add https://github.com/rustomax/observe-community-mcp --skill filtering-event-datasets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables rapid filtering and discovery within event datasets (logs) using OPAL, reducing manual log-wrangling and speeding incident investigation.

Core Features & Use Cases

Pattern-based filtering: search logs with contains(), or regex using ~, and field-value filtering for metadata like namespace, pod, and level.
Boolean logic and sampling: combine multiple conditions with and/or/not and sample results with limit for quick triage.
Discovery workflow guidance: start with dataset discovery, inspect schema, build and run OPAL queries, and interpret results.

Quick Start

Use the filtering-event-datasets skill to search logs containing the word 'error' across a Kubernetes namespace, then limit results to 100 for sampling.

Frequently Asked Questions about filtering-event-datasets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I filter event datasets to quickly locate relevant logs?▼

You can filter event datasets using OPAL queries with text search, regex matching, and field-value filters across log interfaces like body and resource_attribute. This enables rapid pattern matching to locate relevant events for incident investigation.

Can I use regex and boolean logic when searching through log datasets?▼

Yes, you can search log datasets using regex with the ~ operator and combine multiple conditions with and/or/not boolean logic. This allows precise pattern-based filtering to isolate specific events across body and resource_attribute fields.

How do I discover log schema and sample results during incident triage?▼

Start with dataset discovery using the discover_context command to inspect schema, then build and run OPAL queries to filter events. Use the limit command to sample results, such as 100 entries, for quick triage during investigations.

Do I need any special setup to use OPAL for filtering logs in Observe?▼

No special setup is required beyond having an Observe MCP-enabled environment. The skill provides commands like discover_context, contains, and limit to start filtering log datasets immediately without additional dependencies or components.

What is the best way to search Kubernetes namespace logs for specific error levels?▼

The best way to search Kubernetes logs is using field-value filters for metadata like namespace, pod, and level, combined with the contains() function to match specific error text. This targets relevant log entries across Kubernetes metadata fields.