@thotischner/observability-mcp 1.1.1 → 1.1.3

package/dist/connectors/loki.d.ts

@@ -7,6 +7,8 @@ export declare class LokiConnector implements ObservabilityConnector {
     private baseUrl;
     private auth?;
     private tlsAgent?;
+    private serviceLabels;
+    private labelValuesCache;
     connect(config: SourceConfig): Promise<void>;
     getDefaultMetrics(): MetricDefinition[];
     getMetrics(): MetricDefinition[];
@@ -15,6 +17,8 @@ export declare class LokiConnector implements ObservabilityConnector {
     disconnect(): Promise<void>;
     listServices(): Promise<ServiceInfo[]>;
     queryLogs(params: LogQuery): Promise<LogResult>;
+    private getLabelValues;
+    private resolveServiceSelector;
     private parseLine;
     private extractTopPatterns;
     private parseTimeRange;

package/dist/connectors/loki.js

@@ -1,4 +1,6 @@
 import { buildTlsAgent } from "./tls.js";
+const DEFAULT_SERVICE_LABELS = ["service_name", "service", "job", "app", "container"];
+const LABEL_CACHE_TTL_MS = 60_000;
 export class LokiConnector {
     type = "loki";
     signalType = "logs";
@@ -6,11 +8,17 @@ export class LokiConnector {
     baseUrl = "";
     auth;
     tlsAgent;
+    serviceLabels = DEFAULT_SERVICE_LABELS;
+    labelValuesCache = new Map();
     async connect(config) {
         this.name = config.name;
         this.baseUrl = config.url.replace(/\/$/, "");
         this.auth = config.auth;
         this.tlsAgent = buildTlsAgent(config);
+        const envLabels = process.env.LOKI_SERVICE_LABELS;
+        if (envLabels) {
+            this.serviceLabels = envLabels.split(",").map((s) => s.trim()).filter(Boolean);
+        }
     }
     getDefaultMetrics() {
         // Loki is a log backend — no metric definitions by default
@@ -46,23 +54,40 @@ export class LokiConnector {
     }
     async disconnect() { }
     async listServices() {
-        try {
-            const data = await this.apiGet("/loki/api/v1/label/service/values");
-            return (data?.data || []).map((name) => ({
-                name,
-                source: this.name,
-                signalType: "logs",
-            }));
-        }
-        catch {
-            return [];
+        // Probe each candidate label and merge values. Loki streams may identify
+        // services via service_name, service, job, app, or container depending on
+        // the shipper configuration. Walking all candidates ensures historical
+        // streams remain reachable when label conventions change over time.
+        const seen = new Map();
+        for (const label of this.serviceLabels) {
+            const values = await this.getLabelValues(label);
+            for (const raw of values) {
+                // Docker's loki.source.docker writes container names with a leading '/'
+                // (Docker API Names[0] convention). Strip it for display so the name
+                // matches what the service-name validator and users will pass back in.
+                const display = label === "container" ? raw.replace(/^\//, "") : raw;
+                if (!seen.has(display)) {
+                    seen.set(display, {
+                        name: display,
+                        source: this.name,
+                        signalType: "logs",
+                        labels: { discoveredVia: label },
+                    });
+                }
+            }
         }
+        return Array.from(seen.values());
     }
     async queryLogs(params) {
         const { start, end } = this.parseTimeRange(params.duration);
         const limit = Math.min(Math.max(params.limit || 100, 1), 1000);
-        const service = this.escapeLogQLValue(params.service);
-        let logql = `{service="${service}"}`;
+        // Resolve label + actual selector value. For the 'container' label the
+        // value stored in Loki may be '/my-app-1' while the caller passes the
+        // sanitized 'my-app-1' — return the prefixed form so the LogQL selector
+        // matches the real stream.
+        const { label: matchedLabel, value: rawValue } = await this.resolveServiceSelector(params.service);
+        const service = this.escapeLogQLValue(rawValue);
+        let logql = `{${matchedLabel}="${service}"}`;
         if (params.level) {
             const level = this.escapeLogQLValue(params.level);
             logql += ` | json | level="${level}"`;
@@ -109,6 +134,38 @@ export class LokiConnector {
         };
     }
     // --- Private helpers ---
+    async getLabelValues(label) {
+        const cached = this.labelValuesCache.get(label);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.values;
+        }
+        try {
+            const data = await this.apiGet(`/loki/api/v1/label/${encodeURIComponent(label)}/values`);
+            const values = data?.data || [];
+            this.labelValuesCache.set(label, {
+                values,
+                expiresAt: Date.now() + LABEL_CACHE_TTL_MS,
+            });
+            return values;
+        }
+        catch {
+            this.labelValuesCache.set(label, { values: [], expiresAt: Date.now() + LABEL_CACHE_TTL_MS });
+            return [];
+        }
+    }
+    async resolveServiceSelector(service) {
+        for (const label of this.serviceLabels) {
+            const values = await this.getLabelValues(label);
+            if (values.includes(service))
+                return { label, value: service };
+            // Container label values are Docker-prefixed with '/'. The caller can't
+            // pass that form (validator rejects '/'), so probe the prefixed variant.
+            if (label === "container" && values.includes(`/${service}`)) {
+                return { label, value: `/${service}` };
+            }
+        }
+        return { label: this.serviceLabels[0] || "service_name", value: service };
+    }
     parseLine(line) {
         try {
             return JSON.parse(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thotischner/observability-mcp",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Unified observability gateway for AI agents — one MCP server for Prometheus, Loki, and any backend",
   "type": "module",
   "license": "MIT",