Connect Any Log File to Claude with MCP

MCP · Custom Logs to Claude

Ask Claude about your Custom Logs file, in plain English

Connect Claude, Claude Code, Cursor or any MCP client to Query Streams once. Claude reads the structure of your Custom Logs file, writes the SQL, runs it read-only through the Agent that already sits with your data, and answers with the rows. No database password ever reaches the AI. About ten minutes, and the Free plan covers it.

About 10 minutes Claude, ChatGPT, Cursor + 11 more clients File stays where it is Read-only, always

What you’ll end up with

A Claude that can answer questions about any text log you describe with live, read-only queries over the tables the Agent builds from your files, and tell you which file each answer came from — without ever seeing a login or a file path, and without a firewall change: the Agent already inside your network reads the folder and sends back only the rows. Once the Agent is in place, connecting Claude takes about 90 seconds if you are comfortable with a settings screen. Like this:

Claude · connected to Query Streams Read-only

What errors did the backup job log overnight?

qs_get_table_schema qs_run_query schema_intelligence

This connector has a format with a Timestamp defined. Claude reads the columns of fileset.events, then runs one query for ERROR and WARN messages between midnight and 6 a.m., ordered by event_time:

event_time	file_name	message
2026-09-26 02:14:07	backup.log	ERROR copy failed: access denied on /mnt/nas01/archive
2026-09-26 02:15:09	backup.log	WARN retrying in 60 s (attempt 2 of 3)
2026-09-26 02:17:11	backup.log	ERROR giving up after 3 attempts

The job lost access to the archive share at 02:14 and gave up three minutes later. Ask Claude how many nights this month ended the same way. The answer covers what the Agent had read at its last scan.

How often does the backup job fail, and is it the same problem every time?

qs_run_query qs_run_query

I took each night’s run from fileset.events, matched the start and finish lines, and pulled the failing path out of any ERROR line:

Night	Result	Failing path	Duration
25 Sep	OK	—	1 h 42 m
26 Sep	FAILED	/mnt/nas01/archive	0 h 09 m
27 Sep	FAILED	/mnt/nas01/archive	0 h 08 m

Two nights running, same path, and it aborts nine minutes in with access denied rather than running out of space. Something changed the permissions on the NAS archive share on the 26th. Until it is fixed you have no backup newer than the 25th.

SELECT only, checked by the Agent logged on the MCP Activity tab 6 rows returned across 3 queries

Rather not wire up an AI client at all? On the Business plan, Nova is the assistant built into Query Streams itself. It has every tool Claude gets here, plus the ones Claude does not: it drafts and validates the SQL against your Schema Intelligence model, turns the answer into a chart, and saves the result as a query your team can run from Excel, Google Sheets or the REST API — no key, no connector, nothing to install. Use MCP when your people already live in Claude, Cursor or ChatGPT; use Nova when you want the answers inside the Portal.

Custom Log Folder is for any text log the built-in cards do not know. You describe the format once, or let Nova suggest one, and every line becomes a SQL row Claude can query. That is AI log analysis on your own files, with nothing to upload. The Agent tails each file as it grows, recognises rotated files so nothing is read twice, reads each .gz archive once, and backfills the last 30 days on first read.

What you’ll need

A Query Streams account

MCP is on every plan, including Free. Free allows one key or one connected app, which is all this guide needs. Sign up at my.querystreams.com.

The Agent on a computer that can open the folder

Version 2.6.0 or later. The folder can be on that computer or on a file share it can reach. The Agent runs as a service, so type shares as \\server\share\folder, not as a mapped drive letter. New to the Agent? Install it on Windows, macOS or Linux.

MCP switched on for you

Creators, owners and admins have it from the start. Everyone else needs an admin to flip the MCP switch beside their name under Account → Access Control. Until then the MCP page says “MCP is disabled for your account”.

An AI client

Claude on the web, Claude Desktop or the Claude mobile apps connect with no key. Claude Code, Cursor, ChatGPT and about ten other tools work too; the Portal has a ready-made recipe for each.

Set it up in four steps

1. Point the Agent at the folder

   In the portal open Data → Data Agents, find the Agent that can open the folder and click its Add connector button. Under the Files & Folders pill click the Custom Log Folder card. The wizard then walks you through Folders, Check, Settings, Realm and Review:

   Folders

   Type the Root folders, one per line, as paths on the Agent’s computer. Scan subfolders is on, Max depth is 8. Include patterns starts with the right glob for this file type; add Exclude patterns if the folder holds files you do not want. A mapped drive letter shows an amber advisory: the Agent cannot see it, so use the \\server\share path instead.

   Check

   The Agent reads a sample of up to 64 files and shows what it will build. Nothing is created yet. Ready to create means every sampled file fits. An amber banner, “{n} of {m} file(s) will be set aside”, lists files that do not fit with Show which files and why; you can create the connector anyway and fix them later. If the folder mixes layouts, a blue panel offers Switch to one table per layout.

   Settings

   Scan interval (every hour by default, from every 5 minutes to daily) is how often the Agent looks for new, changed and vanished files. Watch folder for changes reacts within seconds on local disks. When a file vanishes is Drop its rows by default.

   Realm, Review

   Pick the Data Realm the rows count against, check the summary and click Create connector. The first scan starts right away; the connector’s Manifest tab shows what it built and any files it set aside.

   • Add your log folder under Root folders and set Include patterns to match your files.
   • Choose an Encoding. It is required and has no default.
   • Describe the format: Record boundary, Grammar (delimited, key=value, grok, JSON lines, #Fields header or fixed width), Timestamp, Typed columns and Identity column. Or click Let Nova suggest a format, which has a daily cap.
   • On Check, the Agent reads a sample and shows the file count, size, a row estimate and the tables it will build. Nothing is created yet. Test connection also offers the closest built-in log type when one fits.

2. See what tables you get

   Parsed lines land in fileset.events, or in the Table name you chose. The Agent keeps the rows in a local cache on the Agent computer and serves them as SQL. Every row says which file it came from in _source_file. Until you define a format, each line is one message tagged with file_name.

   Table	What it holds
   events	One row per record: event_time, the columns your format defines, and message. With no format yet, event_time is the file’s modified time.
   events_raw_lines	Lines your format did not match, kept in line with a reason such as no-grammar-match. Nothing is dropped.
   files	Every log file in the folder right now, with relative_path, size_bytes and modified_utc.
   files_events	The history of each file: appeared, modified, rotated, truncated and drift rows, timed by event_at.
   log_cursors	Each file’s read position and state. A set-aside file shows state parked with the reason in last_error.

   Every folder connector also gives Claude the same bookkeeping tables, all in the fileset schema:

   Table	What it holds
   files	Every file currently in the folder: path, name, extension, size, created and modified times. Ask “what is in this folder?” and Claude reads this.
   files_events	The change history: one row per file that appeared, was modified, vanished, or was set aside (drift), with the time in event_at and the reason in detail.
   directories, volumes	Folder sizes and counts, and the disks or shares the roots live on.
   _source_file, _row_id	Two columns on every data row: which file the row came from, and a stable row id inside that file. Group by _source_file to compare files.

3. Connect Claude

   Open Streams → Live → MCP. There are two ways in, and they end at the same place:

   Chat apps · no key

   claude.ai, Claude Desktop, ChatGPT

   In Claude, Query Streams is in the Anthropic Connectors Directory: browse connectors, click Connect. Elsewhere you paste one address into the app, https://mcp.querystreams.com/mcp, and connect from a chat. A Query Streams page opens, you pick the organization and the permissions, and click Approve connection. Nothing to copy, nothing to keep secret. The connection appears under Connected Apps and can be revoked there.

   Developer tools · a key

   Claude Code, Cursor, VS Code and friends

   On My Keys click Generate key. Give it a Key name such as “Claude Code on my laptop”, keep Read and Execute ticked, choose an Expiration (Never, 30 days, 90 days or 1 year) and click Generate key. Copy it, then Continue to install: the Connect tab shows the exact snippet for your tool with the key already filled in.

   Both ways use the same three permissions, which you choose on the consent screen or on the key:

   Read

   List connectors, browse tables and columns, read your saved queries and alert rules. Never returns row data.

   Execute

   Run read-only SQL and saved queries through your Agent and return the rows. Without it Claude can describe your data but not answer from it.

   Analyze

   Profile tables, discover relationships and queue a Schema Intelligence run. It spends Nova AI credits and data allowance, so the consent screen never pre-ticks it.

   Lost the key? Open My Keys: the eye icon shows it again and Copy full key copies it. Revoke it there if a laptop goes missing; every client using it fails on its next call, within about five minutes.

   Then pick the recipe for the Claude you use. The server address is the same everywhere: https://mcp.querystreams.com/mcp.

   Claude on the web, Claude Desktop and mobile no key

   1. Open Settings → Connectors and click Browse connectors. Query Streams is listed in the Anthropic Connectors Directory: find Query Streams and click Connect. (Or open the directory listing directly and click Connect there.)
   2. If your organization hides directory connectors, click Add custom connector instead. Name it Query Streams, paste https://mcp.querystreams.com/mcp, leave the OAuth fields empty, click Add, then in any chat click + → Browse connectors → Query Streams → Connect.
   3. A Query Streams tab opens. Sign in if asked, pick the organization, review Read and Execute, optionally Limit to specific connectors, and click Approve connection.
   4. Back in Claude you see “Connected to Query Streams”. The first time Claude uses a tool it asks; choose Always allow.

   If you do add it by hand in Claude Desktop, use Settings → Connectors → Add, not the in-chat Add marketplace option, which expects a git repository. Connectors sync to your Claude account, so the mobile apps and Desktop pick it up automatically. Menu names are Anthropic’s and can move.

   Claude Code key

   One command, with your key from My Keys:

   Terminal

   claude mcp add --transport http querystreams https://mcp.querystreams.com/mcp \
     --header "X-MCP-Key: qsmcp_PASTE_YOUR_KEY_HERE"

   That writes the current project’s .mcp.json. Add --scope user to have Query Streams in every project. Run /mcp inside Claude Code to see it connected.

   Cursor key

   Open Cursor Settings → MCP → Add New MCP Server, or edit .cursor/mcp.json at the root of your workspace:

   .cursor/mcp.json

   {
     "mcpServers": {
       "querystreams": {
         "url": "https://mcp.querystreams.com/mcp",
         "headers": {
           "X-MCP-Key": "qsmcp_PASTE_YOUR_KEY_HERE"
         }
       }
     }
   }

   Restart Cursor or run MCP: Restart Servers; a querystreams badge appears in the MCP status bar.

   Using something else? The Connect tab has ready-to-paste recipes for ChatGPT, VS Code, Visual Studio, OpenAI Codex CLI, Gemini CLI, Windsurf, Zed, Cline, Continue.dev and JetBrains AI, plus a Paste & merge tool that drops the querystreams entry into a config file you already have. Any client that speaks MCP over HTTP works: server https://mcp.querystreams.com/mcp, header X-MCP-Key (an Authorization: Bearer header with the same key also works).

4. Ask your first question

   Start with something you can check by opening the folder, so you see Claude reach for the right table. Three that work well with any text log you describe:

   “Which log files are you reading, and when did each last change?”

   Claude queries fileset.files for relative_path, size_bytes and modified_utc, newest first.

   “Show me every ERROR from the last hour.”

   Claude filters fileset.events on message and the last hour of event_time, newest first.

   “Which lines did my format fail to parse, and why?”

   Claude reads fileset.events_raw_lines, groups by reason and shows examples, so you can adjust the format.

   To confirm the wiring, ask “What Query Streams connectors do I have?”. Claude calls qs_list_connectors, and on My Keys the key’s Last used time updates within a few seconds.

How new, changed and deleted files show up

What Claude can do once connected

Claude sees nineteen small tools. You never call them yourself; Claude picks the right one for your question. In plain terms:

Why Schema Intelligence matters here

Every answer Claude receives is tagged with where the structure came from, and Claude adjusts how much it trusts what it sees.

If a database matters, run Schema Intelligence on it once from Nova → Intelligence. The My Keys tab shows a coverage panel per connector. How Schema Intelligence works.

What the plans allow

MCP is on every plan, including Free, with no separate fee. What each plan sets is how many keys or connected apps you can hold and how many calls a minute Claude may make:

A connected app counts as a key. On top of the per-minute figure, any one key may run at most 10 queries a minute. A query returns up to 1,000 rows and runs for up to 60 seconds unless Claude asks for more, to a ceiling of 50,000 rows and five minutes. The rows Claude receives count against your Data Realm allowance, the same pool your Excel and Sheets queries use, and MCP is measured before compression, so a wide result costs more here than the same rows in a spreadsheet. Schema Intelligence runs started from Claude spend Nova AI credits, exactly as they do from the Portal. See the pricing page for the allowances.

Keeping it safe

Good next moves

• Tune the format by asking Claude which lines landed in events_raw_lines, then edit the connector. Saving a change makes the Agent re-sample.
• Turn on Watch folder for changes (near real-time) to pick up new lines within seconds on a local disk. The scheduled scan stays the guarantee.
• Ask for a built-in type if your format is common. The Portal says: “Need a log type that is not listed? Open a support request and we add it within a few days.”

When something doesn’t work

Questions people ask

Related guides

• Connect a Folder of CSV Files to Claude with MCP
• Connect a Folder of Excel Files to Claude with MCP
• Connect a Folder of SQLite Databases to Claude with MCP
• Connect a Folder of Parquet Files to Claude with MCP
• Connect Query Streams to Claude via MCP: setup, permissions and troubleshooting
• All MCP guides