VictoriaLogs - OpenSRE Documentation

OpenSRE queries VictoriaLogs using LogsQL to retrieve structured log evidence — correlating recent application errors, request anomalies, and stream-level events with the alert under investigation.

Prerequisites

A reachable VictoriaLogs instance (e.g. http://vmlogs:9428)
LogsQL knowledge for any custom queries you want OpenSRE to run

Setup

Option 1: Environment variables

Add to your .env:

VICTORIA_LOGS_URL=http://vmlogs.monitoring.svc:9428

# Optional — only set this if your deployment is multi-tenant.
# Single-tenant clusters should leave it unset; OpenSRE will not send
# the AccountID header at all.
# VICTORIA_LOGS_TENANT_ID=acme

Variable	Default	Description
`VICTORIA_LOGS_URL`	—	Required. Base URL of your VictoriaLogs instance
`VICTORIA_LOGS_TENANT_ID`	(unset)	Optional. Sent as the `AccountID` header on multi-tenant deployments

Option 2: Persistent store

{
  "version": 1,
  "integrations": [
    {
      "id": "victoria-logs-prod",
      "service": "victoria_logs",
      "status": "active",
      "credentials": {
        "base_url": "http://vmlogs.monitoring.svc:9428"
      }
    }
  ]
}

Verify

opensre integrations verify victoria_logs

Expected output:

Service: victoria_logs
Status:  passed
Detail:  Connected to VictoriaLogs at http://vmlogs.monitoring.svc:9428.

How it works in investigations

When VictoriaLogs is configured, the victoria_logs_query tool becomes available to the investigation agent. It runs LogsQL queries against /select/logsql/query and returns structured rows — defaulting to a wildcard match over the past hour, but the agent narrows the query based on alert context (service, level, trace ID, time window). Typical agent uses:

Pull recent error-level logs for the affected service to surface stack traces
Filter by request ID or trace ID to follow a single failing transaction across services
Compare log volume in the incident window against a known-good baseline to spot regressions

Troubleshooting

Symptom	Fix
Status: missing	Set `VICTORIA_LOGS_URL` or add a `victoria_logs` entry to your integrations store
Connection refused	Verify the URL is reachable from this host; check firewall rules
404 on `/select/logsql/query`	Confirm you are pointing at VictoriaLogs (not VictoriaMetrics for time-series); they expose different endpoints
Empty rows	Normal when no logs match — widen the time range with a longer `start` (e.g. `-24h`) or relax the LogsQL filter

Splunk X (Twitter) MCP

​Prerequisites

​Setup

​Option 1: Environment variables

​Option 2: Persistent store

​Verify

​How it works in investigations

​Troubleshooting