shield_lock
JinDaGe
← Back to skills
extension
Category: Development & EngineeringNo API key required

Query Axiom Logs

Query logs from Axiom for debugging (read-only, no ingestion allowed)

personAuthor: jakexiaohubgithub
open_in_newRepositorydownloadDownload package

Query Axiom Logs

You are a log analysis specialist for the vm0 project. Your role is to query and analyze logs from Axiom for debugging purposes.

IMPORTANT: This skill is READ-ONLY. Never ingest or write data to Axiom.

Your Task

Execute the following request: $ARGUMENTS

Query logs and telemetry data from Axiom using the guidelines and examples below.

Environment Setup

AXIOM_TOKEN Location

The token is stored in turbo/apps/web/.env.local:

AXIOM_TOKEN=xaat-xxxxx

If Token is Missing

Ask the user to sync environment variables from 1Password:

./scripts/sync-env.sh

This syncs AXIOM_TOKEN from op://Development/vm0-env-local/axiom_token.

Available Datasets

| Dataset | Dev Name | Purpose | |---------|----------|---------| | Web Logs | vm0-web-logs-dev | Server logs (errors, warnings, API calls) | | Agent Run Events | vm0-agent-run-events-dev | Agent execution events and activity | | Sandbox System | vm0-sandbox-telemetry-system-dev | Sandbox console/system logs | | Sandbox Metrics | vm0-sandbox-telemetry-metrics-dev | CPU, memory, disk usage | | Sandbox Network | vm0-sandbox-telemetry-network-dev | HTTP requests from sandbox |

For production, replace -dev with -prod.

Query Command

source turbo/apps/web/.env.local && axiom query "APL_QUERY" -T "$AXIOM_TOKEN" -f table

Options:

  • -f table - Human-readable table (default)
  • -f json - JSON output for processing
  • --start-time "-1h" - Filter by time range

APL Query Syntax

['dataset-name']
| where condition
| project field1, field2
| limit 100

Common Operators

| Operator | Example | |----------|---------| | Filter | where level == "error" | | Search | search "connection refused" | | Time | where _time > now(-1h) | | Select | project _time, message | | Sort | sort by _time desc | | Limit | limit 100 | | Count | summarize count() by field |

Common Queries

Web Logs - Find Errors

source turbo/apps/web/.env.local && axiom query "['vm0-web-logs-dev'] | where _time > now(-1h) | where level == 'error' | project _time, message, fields.context | sort by _time desc | limit 50" -T "$AXIOM_TOKEN"

Web Logs - Search Text

source turbo/apps/web/.env.local && axiom query "['vm0-web-logs-dev'] | search 'connection refused' | project _time, message | limit 20" -T "$AXIOM_TOKEN" --start-time "-24h"

Agent Events - By Run ID

source turbo/apps/web/.env.local && axiom query "['vm0-agent-run-events-dev'] | where runId == 'UUID_HERE' | sort by sequenceNumber asc" -T "$AXIOM_TOKEN"

Agent Events - Failed Runs

source turbo/apps/web/.env.local && axiom query "['vm0-agent-run-events-dev'] | where _time > now(-1h) | where eventType == 'system' | where eventData.subtype == 'error' | project _time, runId, eventData.message | limit 20" -T "$AXIOM_TOKEN"

Sandbox Logs - By Run ID

source turbo/apps/web/.env.local && axiom query "['vm0-sandbox-telemetry-system-dev'] | where runId == 'UUID_HERE' | sort by _time asc" -T "$AXIOM_TOKEN"

Sandbox Metrics - Resource Usage

source turbo/apps/web/.env.local && axiom query "['vm0-sandbox-telemetry-metrics-dev'] | where runId == 'UUID_HERE' | project _time, cpu, mem_used, disk_used | sort by _time asc" -T "$AXIOM_TOKEN"

Sandbox Network - HTTP Errors

source turbo/apps/web/.env.local && axiom query "['vm0-sandbox-telemetry-network-dev'] | where _time > now(-1h) | where status >= 400 | project _time, method, url, status, latency_ms | limit 50" -T "$AXIOM_TOKEN"

Dataset Fields Reference

vm0-web-logs-dev

| Field | Description | |-------|-------------| | _time | Event timestamp | | level | Log level (error, warn, info, debug) | | message | Log message | | fields.context | Context (webhook:complete, api:runs, etc.) | | vercel.environment | Vercel env (preview, production) | | vercel.region | Vercel region (iad1, etc.) |

vm0-agent-run-events-dev

| Field | Description | |-------|-------------| | _time | Event timestamp | | runId | Agent run UUID | | userId | User ID | | eventType | Type (system, assistant, tool) | | eventData.type | Subtype details | | eventData.message | Event message content | | sequenceNumber | Event sequence in run |

vm0-sandbox-telemetry-system-dev

| Field | Description | |-------|-------------| | _time | Event timestamp | | runId | Agent run UUID | | userId | User ID | | log | Raw log text |

vm0-sandbox-telemetry-metrics-dev

| Field | Description | |-------|-------------| | _time | Timestamp | | runId | Agent run UUID | | cpu | CPU usage (0-1) | | mem_total, mem_used | Memory in bytes | | disk_total, disk_used | Disk in bytes |

vm0-sandbox-telemetry-network-dev

| Field | Description | |-------|-------------| | _time | Timestamp | | runId | Agent run UUID | | method | HTTP method | | url | Request URL | | status | HTTP status code | | latency_ms | Latency in milliseconds | | request_size, response_size | Bytes |

Constraints

  • Maximum 65,000 rows per query
  • Always use limit to avoid large result sets
  • Prefer aggregations (summarize count()) over raw queries when possible