Skip to content

fix(search): Pass regex log queries through as written - #1409

Open
JoshuaKGoldberg wants to merge 17 commits into
mainfrom
joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as
Open

JoshuaKGoldberg wants to merge 17 commits into
mainfrom
joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as

Conversation

@JoshuaKGoldberg

Copy link
Copy Markdown
Member

The search tools now recognize key://pattern// regex log filters as Sentry search syntax, so a regex query runs as written instead of being treated as natural language and rewritten. Rewriting a regex into a wildcard now counts as a filter downgrade, and the search_logs description mentions the syntax.

Closes LOGS-1015

@linear-code

linear-code Bot commented Oct 5, 2026

Copy link
Copy Markdown

LOGS-1015

@JoshuaKGoldberg
JoshuaKGoldberg changed the base branch from main to joshgoldberg/logs-1014-teach-sentry-mcps-search-agent-regex-log-search October 5, 2026 16:32
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from f62e4c8 to 7277c79 Compare October 5, 2026 16:32
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from 7277c79 to 80ba22e Compare October 5, 2026 16:42
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from 80ba22e to d801aab Compare October 5, 2026 18:17
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from d801aab to 85f016a Compare October 5, 2026 19:11
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from 85f016a to d33ede4 Compare October 5, 2026 19:27
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from d33ede4 to d1be5cb Compare October 5, 2026 19:38
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from d1be5cb to a0082d7 Compare October 5, 2026 20:13
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from a0082d7 to 863cfb1 Compare October 5, 2026 20:36

@cursor cursor Bot left a comment •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

Comment thread packages/mcp-core/src/tools/support/search-events/utils.ts
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from 9bbcdeb to 821bccb Compare October 7, 2026 16:21
JoshuaKGoldberg and others added 15 commits October 13, 2026 09:50
Add logs text-matching guidance to the embedded query-translation agent
prompt so it uses `key://pattern//` regex filters when wildcards cannot
express the request, and add regex few-shot examples for the logs dataset.

Refs LOGS-1014
Co-Authored-By: Claude Code <noreply@anthropic.com>
…ldcards

Teach prefix, suffix, and wildcard-list matching so plain alternatives
and anchors don't reach for a regex, keep exact value sets as key:[a,b],
and swap examples that overlapped the regex evals or needed no regex.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… regex

A value with its own attribute, like a response status, should filter
that attribute rather than a regex over message text.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…id example

Wildcards are case sensitive, so ignoring case is a regex trigger; the
trace id few-shot is replaced since trace has its own attribute, and
array attributes are noted as regex-capable.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Array regex needs the tags[name,array][*] key form, so naming arrays
without it invites a plain key regex that silently matches nothing.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…r limit

An unneeded \b or (?i) pushed a UUID pattern past Sentry's limit in an
eval run, so the length rule now says to leave them out unless needed.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The agent still wrote key://pattern// for errors in some eval runs, so
the rule now names the other datasets and says to use wildcards there.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…gex limit

An eval run spelled a UUID with [0-9a-fA-F], landing at 75 characters, so
the length rule now says to match either case with (?i) and a lowercase
class, which fits a UUID in 64.

Refs LOGS-1014
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Recognize `key://pattern//` regex filters as Sentry search syntax so
regex-only log queries are no longer treated as natural language and
replaced by Seer or embedded-agent rewrites. Treat a regex rewritten into
a plain or wildcard filter as a downgrade, keep regex values with spaces
or apostrophes as one token, and mention regex syntax in search_logs.

Refs LOGS-1015
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sentry only runs key://pattern// as a regex on logs; other datasets match
the literal text, so a regex sent to search_spans or search_errors now
lets the agent's rewrite through instead of forcing an empty search.

Refs LOGS-1015
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…shapes

A regex right after ( or on a typed, colon, quoted, or [*] key now counts
as a regex filter, and changing the pattern (including its case) counts
as a downgrade.

Refs LOGS-1015
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Colon and uppercase bracket keys now take the regex path, wildcard
rewrites are caught on every regex key shape, a regex may follow ) or a
quote, and key detection no longer rescans the whole query prefix.

Refs LOGS-1015
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Refs LOGS-1015
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A natural-language log query with a URL ending in `//` matched the
key://pattern// shape, so it skipped the search agent and blocked valid
rewrites as downgrades.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@JoshuaKGoldberg
JoshuaKGoldberg force-pushed the joshgoldberg/logs-1015-pass-regex-log-queries-through-sentry-mcps-search-tools-as branch from 7c9abff to d85afd6 Compare October 13, 2026 13:50
Base automatically changed from joshgoldberg/logs-1014-teach-sentry-mcps-search-agent-regex-log-search to main October 13, 2026 15:27
…s-through-sentry-mcps-search-tools-as

# Conflicts:
#	packages/mcp-core/src/tools/support/search-events/config.ts
#	packages/mcp-core/src/tools/support/search-events/utils.ts

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 55756fd. Configure here.

Comment thread packages/mcp-core/src/tools/support/search-events/utils.ts
Comment thread packages/mcp-core/src/tools/support/search-events/utils.ts
Comment thread packages/mcp-core/src/tools/support/search-events/utils.ts
Structured filters rewritten into key://pattern// were missed outside
logs, and when the pattern's casing differed from the original value.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch was successfully deployed

1 active deployment
Actions — e6779a39 Deployed Oct 13, 2026 by JoshuaKGoldberg via eval #1297
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk: medium PR risk score: medium

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant