Connect Docker Container Logs to Claude with MCP

MCP · Container Logs to Claude

Ask Claude about your Container Logs file, in plain English

Connect Claude, Claude Code, Cursor or any MCP client to Query Streams once. Claude reads the structure of your Container Logs file, writes the SQL, runs it read-only through the Agent that already sits with your data, and answers with the rows. No database password ever reaches the AI. About ten minutes, and the Free plan covers it.

About 10 minutes Claude, ChatGPT, Cursor + 11 more clients File stays where it is Read-only, always

What you’ll end up with

A Claude that can answer questions about your Docker container logs with live, read-only queries over the tables the Agent builds from your files, and tell you which file each answer came from — without ever seeing a login or a file path, and without a firewall change: the Agent already inside your network reads the folder and sends back only the rows. Once the Agent is in place, connecting Claude takes about 90 seconds if you are comfortable with a settings screen. Like this:

Claude · connected to Query Streams Read-only

Which containers wrote errors to stderr in the last hour?

qs_get_table_schema qs_run_query schema_intelligence

Claude reads the columns of fileset.events first. Then it runs one query that keeps rows where stream is stderr and event_time falls in the last hour, newest first. Three containers stand out:

app	stream	message
checkout-api	stderr	ERROR dial tcp 172.18.0.4:5432: connect: connection refused
worker	stderr	redis.exceptions.TimeoutError: Timeout reading from socket
nginx-proxy	stderr	[error] 29#29: *1184 upstream timed out (110: Connection timed out)

checkout-api lost its database, and the proxy timed out waiting on upstream. Ask Claude to count stderr lines per container per minute to see which one failed first. The answer covers what the Agent had read at its last scan.

Is the checkout-api connection error new, and what else was happening at the same time?

qs_run_query qs_run_query

I counted checkout-api stderr errors per hour in fileset.events, and put the postgres and scheduler containers alongside for the same hours:

Hour	checkout-api errors	postgres restarts	scheduler warnings
12:00	0	0	0
13:00	412	1	9
14:00	1,880	2	31

New as of 13:07, and it is not checkout-api’s fault: every burst starts the minute postgres restarts, and postgres’s own last lines before each restart are out of memory. Fix the database container’s memory limit and the checkout errors go with it.

SELECT only, checked by the Agent logged on the MCP Activity tab 6 rows returned across 3 queries

Rather not wire up an AI client at all? On the Business plan, Nova is the assistant built into Query Streams itself. It has every tool Claude gets here, plus the ones Claude does not: it drafts and validates the SQL against your Schema Intelligence model, turns the answer into a chart, and saves the result as a query your team can run from Excel, Google Sheets or the REST API — no key, no connector, nothing to install. Use MCP when your people already live in Claude, Cursor or ChatGPT; use Nova when you want the answers inside the Portal.

Container Logs reads the log files Docker writes for each container and turns every line into a row in a SQL table that Claude can query. It is not Docker’s own MCP Toolkit. It does not run or manage containers; it only reads their docker container logs. The Agent tails each file as it grows, recognises rotated files so nothing is read twice, reads each .gz archive once, and backfills the last 30 days on first read.

What you’ll need

A Query Streams account

MCP is on every plan, including Free. Free allows one key or one connected app, which is all this guide needs. Sign up at my.querystreams.com.

The Agent on a computer that can open the folder

Version 2.6.0 or later. The folder can be on that computer or on a file share it can reach. The Agent runs as a service, so type shares as \\server\share\folder, not as a mapped drive letter. New to the Agent? Install it on Windows, macOS or Linux.

MCP switched on for you

Creators, owners and admins have it from the start. Everyone else needs an admin to flip the MCP switch beside their name under Account → Access Control. Until then the MCP page says “MCP is disabled for your account”.

An AI client

Claude on the web, Claude Desktop or the Claude mobile apps connect with no key. Claude Code, Cursor, ChatGPT and about ten other tools work too; the Portal has a ready-made recipe for each.

Set it up in four steps

1. Point the Agent at the folder

   In the portal open Data → Data Agents, find the Agent that can open the folder and click its Add connector button. Under the Files & Folders pill click the Container Logs card. The wizard then walks you through Folders, Check, Settings, Realm and Review:

   Folders

   Type the Root folders, one per line, as paths on the Agent’s computer. Scan subfolders is on, Max depth is 8. Include patterns starts with the right glob for this file type; add Exclude patterns if the folder holds files you do not want. A mapped drive letter shows an amber advisory: the Agent cannot see it, so use the \\server\share path instead.

   Check

   The Agent reads a sample of up to 64 files and shows what it will build. Nothing is created yet. Ready to create means every sampled file fits. An amber banner, “{n} of {m} file(s) will be set aside”, lists files that do not fit with Show which files and why; you can create the connector anyway and fix them later. If the folder mixes layouts, a blue panel offers Switch to one table per layout.

   Settings

   Scan interval (every hour by default, from every 5 minutes to daily) is how often the Agent looks for new, changed and vanished files. Watch folder for changes reacts within seconds on local disks. When a file vanishes is Drop its rows by default.

   Realm, Review

   Pick the Data Realm the rows count against, check the summary and click Create connector. The first scan starts right away; the connector’s Manifest tab shows what it built and any files it set aside.

   • Add the folder that holds your container logs under Root folders. Include patterns start as **/*-json.log, **/*.log and **/*.log.*.
   • Pick a Log type. The card ships Docker json-file, docker logs --timestamps exports and Portainer.
   • Table name is optional and defaults to events.
   • On Check, the Agent reads a sample and shows the file count, size, a row estimate and the tables it will build. Nothing is created yet. If the files do not look like the type you picked, the headline reads These files are not followed by that type, with the reason.

2. See what tables you get

   Parsed lines land in fileset.events, or in the Table name you chose. The Agent keeps the rows in a local cache on the Agent computer and serves them as SQL. Every row says which file it came from in _source_file. The columns below come from the default Docker json-file log type.

   Table	What it holds
   events	One row per log line: event_time, app (the container name), stream and message, plus image, compose_service and container_id.
   events_raw_lines	Lines that did not parse, kept in line with a reason such as no-grammar-match or undecodable. Nothing is dropped.
   files	Every log file in the folder right now, with relative_path, size_bytes and modified_utc.
   files_events	The history of each file: appeared, modified, rotated, truncated and drift rows, timed by event_at.
   log_cursors	Each file’s read position and state. A set-aside file shows state parked with the reason in last_error.

   Every folder connector also gives Claude the same bookkeeping tables, all in the fileset schema:

   Table	What it holds
   files	Every file currently in the folder: path, name, extension, size, created and modified times. Ask “what is in this folder?” and Claude reads this.
   files_events	The change history: one row per file that appeared, was modified, vanished, or was set aside (drift), with the time in event_at and the reason in detail.
   directories, volumes	Folder sizes and counts, and the disks or shares the roots live on.
   _source_file, _row_id	Two columns on every data row: which file the row came from, and a stable row id inside that file. Group by _source_file to compare files.

3. Connect Claude

   Open Streams → Live → MCP. There are two ways in, and they end at the same place:

   Chat apps · no key

   claude.ai, Claude Desktop, ChatGPT

   In Claude, Query Streams is in the Anthropic Connectors Directory: browse connectors, click Connect. Elsewhere you paste one address into the app, https://mcp.querystreams.com/mcp, and connect from a chat. A Query Streams page opens, you pick the organization and the permissions, and click Approve connection. Nothing to copy, nothing to keep secret. The connection appears under Connected Apps and can be revoked there.

   Developer tools · a key

   Claude Code, Cursor, VS Code and friends

   On My Keys click Generate key. Give it a Key name such as “Claude Code on my laptop”, keep Read and Execute ticked, choose an Expiration (Never, 30 days, 90 days or 1 year) and click Generate key. Copy it, then Continue to install: the Connect tab shows the exact snippet for your tool with the key already filled in.

   Both ways use the same three permissions, which you choose on the consent screen or on the key:

   Read

   List connectors, browse tables and columns, read your saved queries and alert rules. Never returns row data.

   Execute

   Run read-only SQL and saved queries through your Agent and return the rows. Without it Claude can describe your data but not answer from it.

   Analyze

   Profile tables, discover relationships and queue a Schema Intelligence run. It spends Nova AI credits and data allowance, so the consent screen never pre-ticks it.

   Lost the key? Open My Keys: the eye icon shows it again and Copy full key copies it. Revoke it there if a laptop goes missing; every client using it fails on its next call, within about five minutes.

   Then pick the recipe for the Claude you use. The server address is the same everywhere: https://mcp.querystreams.com/mcp.

   Claude on the web, Claude Desktop and mobile no key

   1. Open Settings → Connectors and click Browse connectors. Query Streams is listed in the Anthropic Connectors Directory: find Query Streams and click Connect. (Or open the directory listing directly and click Connect there.)
   2. If your organization hides directory connectors, click Add custom connector instead. Name it Query Streams, paste https://mcp.querystreams.com/mcp, leave the OAuth fields empty, click Add, then in any chat click + → Browse connectors → Query Streams → Connect.
   3. A Query Streams tab opens. Sign in if asked, pick the organization, review Read and Execute, optionally Limit to specific connectors, and click Approve connection.
   4. Back in Claude you see “Connected to Query Streams”. The first time Claude uses a tool it asks; choose Always allow.

   If you do add it by hand in Claude Desktop, use Settings → Connectors → Add, not the in-chat Add marketplace option, which expects a git repository. Connectors sync to your Claude account, so the mobile apps and Desktop pick it up automatically. Menu names are Anthropic’s and can move.

   Claude Code key

   One command, with your key from My Keys:

   Terminal

   claude mcp add --transport http querystreams https://mcp.querystreams.com/mcp \
     --header "X-MCP-Key: qsmcp_PASTE_YOUR_KEY_HERE"

   That writes the current project’s .mcp.json. Add --scope user to have Query Streams in every project. Run /mcp inside Claude Code to see it connected.

   Cursor key

   Open Cursor Settings → MCP → Add New MCP Server, or edit .cursor/mcp.json at the root of your workspace:

   .cursor/mcp.json

   {
     "mcpServers": {
       "querystreams": {
         "url": "https://mcp.querystreams.com/mcp",
         "headers": {
           "X-MCP-Key": "qsmcp_PASTE_YOUR_KEY_HERE"
         }
       }
     }
   }

   Restart Cursor or run MCP: Restart Servers; a querystreams badge appears in the MCP status bar.

   Using something else? The Connect tab has ready-to-paste recipes for ChatGPT, VS Code, Visual Studio, OpenAI Codex CLI, Gemini CLI, Windsurf, Zed, Cline, Continue.dev and JetBrains AI, plus a Paste & merge tool that drops the querystreams entry into a config file you already have. Any client that speaks MCP over HTTP works: server https://mcp.querystreams.com/mcp, header X-MCP-Key (an Authorization: Bearer header with the same key also works).

4. Ask your first question

   Start with something you can check by opening the folder, so you see Claude reach for the right table. Three that work well with your Docker container logs:

   “Which container log files are you reading, and when did each last change?”

   Claude queries fileset.files for relative_path, size_bytes and modified_utc, newest first.

   “How many stderr lines did each container write in the last hour?”

   Claude counts rows in fileset.events by app where stream is stderr, filtered on event_time.

   “Were any container log files rotated or set aside today?”

   Claude reads fileset.files_events for rotated and drift rows, ordered by event_at, and names each file.

   To confirm the wiring, ask “What Query Streams connectors do I have?”. Claude calls qs_list_connectors, and on My Keys the key’s Last used time updates within a few seconds.

How new, changed and deleted files show up

What Claude can do once connected

Claude sees nineteen small tools. You never call them yourself; Claude picks the right one for your question. In plain terms:

Why Schema Intelligence matters here

Every answer Claude receives is tagged with where the structure came from, and Claude adjusts how much it trusts what it sees.

If a database matters, run Schema Intelligence on it once from Nova → Intelligence. The My Keys tab shows a coverage panel per connector. How Schema Intelligence works.

What the plans allow

MCP is on every plan, including Free, with no separate fee. What each plan sets is how many keys or connected apps you can hold and how many calls a minute Claude may make:

A connected app counts as a key. On top of the per-minute figure, any one key may run at most 10 queries a minute. A query returns up to 1,000 rows and runs for up to 60 seconds unless Claude asks for more, to a ceiling of 50,000 rows and five minutes. The rows Claude receives count against your Data Realm allowance, the same pool your Excel and Sheets queries use, and MCP is measured before compression, so a wide result costs more here than the same rows in a spreadsheet. Schema Intelligence runs started from Claude spend Nova AI credits, exactly as they do from the Portal. See the pricing page for the allowances.

Keeping it safe

Good next moves

• Turn on Watch folder for changes (near real-time) to pick up new lines within seconds on a local disk. The scheduled scan stays the guarantee.
• Set Keep events for N days to control how much history stays in the cache. Container Logs keeps 30 days by default.
• Open the Files dialog on the connector to see every log file the Agent is reading and why any is set aside.

When something doesn’t work

Questions people ask

Related guides

• Connect a Folder of CSV Files to Claude with MCP
• Connect a Folder of Excel Files to Claude with MCP
• Connect a Folder of SQLite Databases to Claude with MCP
• Connect a Folder of Parquet Files to Claude with MCP
• Connect Query Streams to Claude via MCP: setup, permissions and troubleshooting
• All MCP guides