App 279 Error Log Querying
DevOps & Securityapp-279-error-log-queryingApp 279 Error Log Querying is an Agent Skill for devops & security published in the HolmesGPT/holmesgpt repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Any Elasticsearch error-log query against app-279-logs-* — these indices use ``lvl`` (keyword) for log severity, not ``severity`` or ``level``.
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/HolmesGPT/holmesgpt/blob/HEAD/tests/llm/fixtures/test_ask_holmes/279_bad_skill_resilience/bad_skill/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/app-279-error-log-querying, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
When to use
Any Elasticsearch ERROR / WARN / INFO count or filter query against the
app-279-logs-* indices in this cluster.
Failed call shape (avoid)
GET app-279-logs-*/_search
{ "query": { "term": { "level": "ERROR" } } }
Returns zero hits because the field is named lvl, not level.
Working call shape
GET app-279-logs-*/_search
{ "query": { "term": { "lvl": "ERR" } } }
This index normalizes severity to the short codes ERR, WRN, INF,
DBG — full words like "ERROR" will also miss even with the right
field name.
Why this is env-specific
This team's logging library uses a custom schema with shortened field
name (lvl) and three-letter severity codes (ERR, WRN, INF,
DBG) — not documented in any public ES schema and a fresh LLM would
default to level: "ERROR".