npm install -g openobserve-mcp
# or without installing:
npx openobserve-mcp --config /path/to/config.json

{
  "instances": [
    {
      "id": "prod",
      "name": "Production",
      "url": "https://openobserve.example.com",
      "auth": { "type": "env", "envVar": "PROD_O2_TOKEN" },
      "defaults": { "org": "default", "timeout": 30000, "maxResults": 1000 },
      "capabilities": ["logs", "traces", "metrics"],
      "tags": ["production"]
    }
  ],
  "batching": { "maxConcurrent": 5 },
  "caching": { "enabled": true, "ttl": 300, "maxSize": 1000 }
}

export PROD_O2_TOKEN=$(echo -n "user@example.com:password" | base64)

{
  "mcpServers": {
    "openobserve": {
      "command": "npx",
      "args": ["openobserve-mcp", "--config", "/path/to/config.json"],
      "env": {
        "PROD_O2_TOKEN": "base64token"
      }
    }
  }
}

{
  "mcp": {
    "openobserve": {
      "type": "local",
      "command": ["npx", "openobserve-mcp", "--config", "/path/to/config.json"],
      "environment": {
        "PROD_O2_TOKEN": "base64token"
      },
      "enabled": true
    }
  }
}

-- Basic filter
SELECT * FROM "mystream" WHERE level = 'error'

-- Full-text search
SELECT * FROM "mystream" WHERE match_all('timeout*')

-- Aggregation
SELECT code, COUNT(*) FROM "mystream" GROUP BY code ORDER BY COUNT(*) DESC

-- Time bucketing (do not add _timestamp filters manually)
SELECT histogram(_timestamp, '1 hour') AS ts, COUNT(*) FROM "mystream" GROUP BY ts