Observability Logs Search

It mirrors the Kibana Discover workflow: start with a broad time range and scope filter, then progressively add NOT clauses to exclude noise patterns until you're left with fewer than 20 distinct log categories. The approach is explicitly funnel-based, keeping each intermediate result small (10-20 samples with minimal fields) to avoid blowing up your context window. What stands out is the emphasis on iteration over one-shot queries. The skill keeps reminding you not to stop after round one, which reflects real incident response where the first query almost never surfaces the root cause. Use it when you need to drill into errors, spikes, or anomalies across services and containers.