Better Stack

Create a new chart alert on an existing chart. The chart must support alerts (line_chart, bar_chart, number_chart, or tail_chart with time variables). Call chart_alert_help for configuration reference. Use chart or dashboard first to find the chart ID

create_chart_alert

Create a secure cloud connection for direct ClickHouse query access to logs, spans, and metrics data. Returns connection credentials (host, port, username, password), sample queries for each data type, and cURL command examples. Connections expire after 1 hour by default

create_cloud_connection

Create a new dashboard. Optionally use a template to start with pre-configured charts. Call chart_building_help for guidance on dashboard structure and layout. Optionally specify a source_id to preconfigure the dashboard with that source. Returns the new dashboard ID which can be used with add_chart_to_dashboard to add charts

create_dashboard

Create a new heartbeat that expects a periodic request from a cron job, worker, or other background task, and alerts when that request stops arriving. Provide a `name` for the heartbeat. The heartbeat reports down once no request is received within `period` seconds plus the `grace` window. Use the returned heartbeat URL as the endpoint your job pings on every successful run.

create_heartbeat

Create a new incident providing a summary of the issue, requester email, and other optional details

create_incident

Create a comment on an incident

create_incident_comment

Create an issue for an error in Linear, or a work item in Jira, through the team's integration and link the two. The issue gets Better Stack's standard body (error type, message, call site, stack trace, occurrence counts and a link back) and the integration's configured defaults for team or space, work type, assignee, labels and priority. Better Stack then posts every change to the error state as a comment on the issue. An error that already has an issue through the integration is reported, not duplicated; use link_error_issue to attach an issue that already exists.

create_error_issue

Create a new metric expression (extract-metrics-from-logs rule) on a source. `sql_expression` runs against each log row; log fields live inside the `raw` JSON column — use `JSONExtract(raw, 'path', 'Nullable(Type)')`. The `Nullable(...)` wrapper is required. Nested paths use positional args: `JSONExtract(raw, 'request', 'headers', 'user-agent', 'Nullable(String)')`. Call `source_fields` to see what fields exist. Pass `aggregations` (e.g. `["avg", "count"]`) for an aggregated metric, or omit / pass `[]` for a label (group-by column). Prefer `build_type: new_data` (default). `historical_logs` re-runs the rule over every stored log — expensive; only when the user explicitly asks.

create_metric_expression

Create a new monitor that tracks the availability of a website, host, or service. Provide the `url` to monitor. For ping, TCP, UDP, SMTP, POP, IMAP, and DNS monitors this is the host (e.g. `example.com`) rather than a full URL. The monitor starts checking immediately unless `paused` is set to true.

create_monitor

Register a release for an errors application, so it appears the moment it deploys instead of when its first error arrives. Returns the release ID, usable with remove_release

create_release

Create a new log source in Better Stack. Returns the created source details including ID, ingestion token, ingesting host URL, retention settings, and platform-specific integration documentation links with next steps for configuration

create_source

Create a new status page report

create_status_page_report

Create a new status update for an existing status page report

create_status_page_report_update

Create a section (resource group) on a status page to group resources under a heading

create_status_page_section

Edit an existing application in Better Stack - rename it, pause or resume ingesting, or set its VRL transformations, including the exception grouping program. Only provide the fields you want to change. Use applications or application first to find the application ID.

edit_application

Escalate an ongoing incident to a user, team, schedule, or policy

escalate_incident

Execute a ClickHouse SQL query to retrieve logs, traces/spans, errors, and metrics from telemetry data. - **IMPORTANT**: Use `query_help` to get instructions on how to create the correct query for logs and spans - **IMPORTANT**: Use `errors_query_help` to get instructions on how to create the correct query for errors - **IMPORTANT**: Use `metrics_query_help` to get instructions on how to create the correct query for metrics - Before an `s3Cluster(...)` query over more than a few hours, call `query_windows` with the same arguments: it says whether the range fits one call and, if not, the time windows that do

query

Export a dashboard configuration as JSON. Returns the complete dashboard data structure including charts, sections, presets, and settings

export_dashboard

Get comprehensive details of a specific application including its configuration, retention settings, ingestion details, custom bucket settings (if configured)

application

Get available escalation policies for an incident

available_incident_escalation_policies

Get detailed information about a specific chart alert including its configuration, SQL queries, status, and current incident info. Use chart_alerts first to find the alert ID

chart_alert

Get instructions for creating and configuring chart alerts, including alert types, operators, configuration fields, supported chart types, and common mistakes. Call this before creating or editing chart alerts

chart_alert_help

Get comprehensive instructions for building charts and dashboards, including chart types, units, axis settings, column mapping, legend placement, layout tips, and common mistakes. Call this before creating or editing charts

chart_building_help

Get detailed information about a specific chart including its SQL queries, configuration, and settings. Use dashboard first to find the chart ID

chart

Get detailed information about a specific dashboard including its charts, sections, layout, template variables, and configuration. Use this to understand a dashboard structure before modifying it

dashboard

Get instructions for writing a ClickHouse query to use inside a Better Stack **Dashboard** chart (or chart alert). The query uses template variables (`{{source}}`, `{{time}}`, `{{start_time}}`, `{{end_time}}`) and runs against the source's metrics collection — it is meant to be saved as a dashboard chart via `add_chart_to_dashboard` / `edit_chart`, NOT run directly. To instead write an ad-hoc query you will run directly via `query` or `render_chart`, use `metrics_query_help`.

dashboard_query_help

Read the conversation on an error: comments left in the app, comments posted by an agent over MCP, replies written in the error Slack thread, and comments synced in from a linked Linear issue. Every entry names its author and, when it did not come from the app, how it was posted; a comment left on one occurrence of the error names that event.

error_comments

Get comprehensive details of a specific error including its type, message, call site information, first occurrence, current state (unhandled, unresolved, ignored, resolved, or reoccurred), and linked Linear/Jira issues

error

Get comprehensive instructions for building SQL ClickHouse queries for error tracking, including both error patterns (metrics) and individual exceptions. Explains when to use each source and provides examples for common use cases

errors_query_help

Get detailed information about a specific escalation policy

escalation_policy

Get detailed information about a specific exploration (saved Explore query) including its sources, chart type, template variables, saved time range, and query. Use this to understand an exploration before modifying its source or variables

exploration

Get instructions for writing a ClickHouse query to use inside the Better Stack **Explore logs** page (and live-tail charts) for log and span data. The query uses template variables (`{{source}}`, `{{time}}`, `{{start_time}}`, `{{end_time}}`) and reads fields from the `raw` JSON column — it is meant to be used in the Explore UI, NOT run directly. To instead write an ad-hoc logs/spans query you will run directly via `query`, use `query_help`.

explore_logs_query_help

Get availability summary for a specific heartbeat

heartbeat_availability

Get details of a specific heartbeat

heartbeat

Get comments for an incident

incident_comments

Get detailed information about a specific incident

incident

Get the timeline of events for an incident

incident_timeline

Get comprehensive details about a specific metric. Returns metric overview (data points, active series, available aggregations), definition (SQL expression or JSON path), example queries for different aggregation functions, and Prometheus tags (for pure metrics). Essential for understanding how to query and use a metric

metric

Get instructions for building SQL ClickHouse queries for metrics (available metrics, aggregations, examples) to run directly via the query tools (`query` / `render_chart`), using concrete `remote(...)` / `s3Cluster(...)` collection names and explicit time filters. To instead write a query for use inside a Dashboard chart, use `dashboard_query_help`. Pass `context: 'chart_query'` when the query will be saved as a dashboard chart or chart alert — the prompt will emphasize `{{source}}` / `{{time}}` / `{{start_time}}` / `{{end_time}}` template variables and chart column aliases. (`context: 'direct_query'` is the default, for ad-hoc queries.)

metrics_query_help

Get metrics and cardinality for a source. Returns a paginated table of available metrics (user-defined and ingested) ordered by active series (highest cardinality first), with their names, types, storage layout, data points count, and active series count. Use `name_filter` to search by name: `rabbitmq*`, `*queue*`, `*_total`, or an exact name. When more than 250 metrics match and grouping them by name prefix would shrink the list at least 3x, a prefix summary is returned instead of the list; drill in with the `name_filter` it suggests. `page` applies to whichever table is shown

metrics_schema