Graylog2 / Graylog2/graylog2-server

Add absolute time filter in MCP Server

Open
#26,421 0 comments 0 reactions 0 assignees View on GitHub
feature misc
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

`search_messages` and `aggregate_messages` lack the ability to filter by absolute time ranges, only relative time to `now` are available, requiring a lot of pagination effort to find messages from the past.

## Why?

We are doing some experiments with Graylog MCP Server and the lack of an absolute time range in the `search_messages` and `aggregate_messages` makes the AI Agent to do some kind of binary search with the pagination to find the related messages, this increases the execution time and also the tokens spent.

## Your Environment

* Graylog Version: 7.1.2
* OpenSearch Version: 2.19
* MongoDB Version: 7.0.34
* Operating System: Ubuntu 22.04
* Browser version: Chrome 149

Contributor guide

Open the contributing guide

Research direction

Start by tracing the search_messages and aggregate_messages entry points to understand how their current relative time filters and pagination work. Add support for absolute time ranges so Graylog MCP Server users can retrieve and aggregate messages from a specified past range without binary-search pagination, then verify both entry points cover the requested range.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend-api-design
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.