Can I investigate logs in plain English, and what setup do I need?

Q: Can I investigate logs in plain English, and what setup do I need?

Use Noz in SigNoz Cloud or connect an external assistant through MCP, then check its log results against the recorded evidence.

Last Updated: October 23, 20262 min read

You can investigate logs in plain English with Noz, the AI teammate inside SigNoz Cloud, when it is enabled for your workspace. You can also connect your own assistant through the SigNoz MCP server. Both options work with logs already collected in SigNoz Cloud.

Choose where to ask

To ask Noz, open Noz in your workspace and enter a question in Ask anything. If your services are not sending logs yet, set up log collection first.

If you prefer another assistant, connect it to the SigNoz MCP server. Model Context Protocol (MCP) lets the assistant use tools to search your logs. For SigNoz Cloud, connect a compatible client to the hosted server for your region and authenticate with your workspace URL and a service account API key. Give the account a read-only role for an investigation, because the server also offers tools that can change resources. The setup guide also covers Self-Hosted SigNoz.

Ask Noz about a payment timeout

For example, we created logs for a checkout service, including successful payments and failures. The timeout records have ERROR severity and the message Payment timeout. After sending the example logs to SigNoz Cloud, we gave Noz the service name and a time range. Our request included:

Show ERROR logs whose message contains "Payment timeout".

Noz returned two matching records. The screenshot shows their timestamps and messages, along with an event ID that identifies each record.

Noz shows two Payment timeout records and their UTC timestamps. — *Noz returns two ERROR records with the expected message and UTC timestamps.*

For your own logs, include the service name, symptom, and time range in your question. Ask for the matching records so you can check the answer.

Check the records behind the answer

We checked the two results in Logs Explorer with the same service, time range, severity, and message filters. Their timestamps and messages matched Noz's answer.

You can check your own results the same way. A timeout message tells you what was recorded, but you need more evidence to know why the payment timed out. If you cannot find a record, check that the logs were collected, the service name is correct, and the time range covers the event. Logs must also still be within their retention period.

See natural-language log exploration for more questions.