Skip to main content

Loki MCP Server Examples & Scenarios

These real-world operational scenarios illustrate how AI assistants navigate LogQL queries and perform rapid incident triage using the TalkOps Loki MCP Server.

Scenario 1: Triaging 5xx Errors in a Production Service​

User Prompt:

"We're seeing 502 Bad Gateway errors in checkout-service over the last 30 minutes. Find out what's causing them."

What Happens:

  1. The AI calls get_cluster_labels() to verify available label taxonomy.
  2. It calls get_label_values(name="app", query='{namespace="production"}') to confirm the exact label name (app="checkout-service").
  3. It runs get_query_stats(query='{namespace="production", app="checkout-service"} |= "502"', start="30m") to estimate scan volume (calculates 14.2 MB, safely below the 5 GB guardrail).
  4. The AI executes the LogQL query via execute_logql_query:
{namespace="production", app="checkout-service"} |= "502" | json | status_code >= 500
  1. The query uncovers a recurring upstream timeout: "dial tcp 10.244.3.45:5432: i/o timeout (connecting to db-replica-2)"
  2. The AI summarizes the root cause: database connection pool exhaustion on read replica db-replica-2.

Scenario 2: Computing Error Rates with Metric Queries​

User Prompt:

"Graph the error rate percentage for auth-service compared to total requests over the past 2 hours."

What Happens:

  1. The AI constructs a LogQL metric expression calculating the percentage ratio:
sum(rate({app="auth-service"} |= "level=error" [5m])) 
/ 
sum(rate({app="auth-service"} [5m])) * 100
  1. It calls execute_logql_query with step="1m", start="2h".
  2. The tool parses the returned time-series matrix and identifies that the error rate jumped from 0.04% to 14.8% at 14:15 UTC following a canary deployment.

Scenario 3: Log Structure Analysis on Unstructured NGINX Logs​

User Prompt:

"What fields are available in ingress-nginx logs, and how can we parse client response times?"

What Happens:

  1. The AI calls get_detected_fields(query='{app="ingress-nginx"}').
  2. The tool identifies available keys: status, request_time, upstream_response_time, remote_addr.
  3. It calls get_log_patterns(query='{app="ingress-nginx"}') to retrieve the regex pattern signature.
  4. The AI outputs the exact LogQL query ready to execute:
{app="ingress-nginx"} 
  | pattern `<remote_addr> - <remote_user> [<time>] "<request>" <status> <body_bytes_sent> "<http_referer>" "<http_user_agent>" <request_time> <upstream_response_time>`
  | request_time > 2.0
  1. The operator runs the query to instantly pinpoint all slow client requests without writing manual regex from scratch.