filtering-event-datasets

You can filter event datasets using OPAL queries with text search, regex matching, and field-value filters across log interfaces like body and resource_attribute. This enables rapid pattern matching to locate relevant events for incident investigation.

Yes, you can search log datasets using regex with the ~ operator and combine multiple conditions with and/or/not boolean logic. This allows precise pattern-based filtering to isolate specific events across body and resource_attribute fields.

Start with dataset discovery using the discover_context command to inspect schema, then build and run OPAL queries to filter events. Use the limit command to sample results, such as 100 entries, for quick triage during investigations.

No special setup is required beyond having an Observe MCP-enabled environment. The skill provides commands like discover_context, contains, and limit to start filtering log datasets immediately without additional dependencies or components.

The best way to search Kubernetes logs is using field-value filters for metadata like namespace, pod, and level, combined with the contains() function to match specific error text. This targets relevant log entries across Kubernetes metadata fields.