{"id":82594,"date":"2026-09-09T12:04:13","date_gmt":"2026-09-09T06:34:13","guid":{"rendered":"https:\/\/tothenewone.online\/blog\/?p=82594"},"modified":"2026-10-27T23:26:44","modified_gmt":"2026-10-27T17:56:44","slug":"query-your-logs-with-ai-building-an-mcp-powered-es-log-search-system","status":"publish","type":"post","link":"https:\/\/tothenewone.online\/blog\/query-your-logs-with-ai-building-an-mcp-powered-es-log-search-system\/","title":{"rendered":"Query Your Logs with AI: Building an MCP Powered ES Log Search System"},"content":{"rendered":"

Introduction<\/h2>\n
\n

\"Architecture\"<\/a><\/p>\n

If you have ever spent 20 minutes writing a Kibana query just to find one error, this post is for you.<\/p>\n

I built a small project on a single AWS server where I could just type “show me the last 502 errors” in plain English, and get a real answer pulled straight from Elasticsearch. No query language, no dashboard clicking around. Here is what I used, why I used it, and how I set the whole thing up.<\/p>\n

First, what is MCP?<\/strong><\/p>\n

MCP stands for Model Context Protocol. Anthropic (the company behind Claude) built it and made it open, so anyone can use it.<\/p>\n

Here’s the simple way to think about it: an AI model like Claude is smart, but on its own it can’t reach into your systems and check anything live. It doesn’t know what’s in your Elasticsearch, your database, or your CloudWatch dashboard. MCP is the bridge that lets it reach out and actually check.<\/p>\n

What is Elasticsearch doing here?<\/strong><\/p>\n

 <\/p>\n

\"this<\/a><\/p>\n

 <\/p>\n

Elasticsearch is just where the logs live\u00a0 \u00a0a search engine built to hold huge amounts of log data and let you filter through it fast. In production, it’s usually paired with Fluentd or Fluent Bit (which ship logs from your apps into it) and Kibana (a dashboard to view them)\u00a0 that combo is called EFK.<\/p>\n

For this POC, I skipped real log collection and just wrote a small script to generate fake entries\u00a0 random status codes, random service names, enough to search through.<\/p>\n

MCP tools are just normal Python functions, exposed so an AI model can call them when needed. So instead of building a chatbot from scratch to understand “show me errors,” I wrote one function that does that job, and let MCP make it available to Claude.<\/p>\n

What does the Python code actually do?<\/strong>
\nThere are two small Python scripts in this whole setup, and neither is complicated.<\/p>\n

Script 1 \u2014<\/strong> the log generator. This one just creates fake log entries and pushes them into Elasticsearch, one by one. Each entry has a timestamp, a status code, a service name, and a message. Nothing fancy, just enough to make the data feel real.<\/p>\n

 <\/p>\n

 <\/p>\n

\n

Script 2 \u2014<\/strong> the MCP server. This is the actual bridge I mentioned earlier. It’s a Python file that defines a handful of functions, each doing one specific job:<\/p>\n