Connect Nginx, Apache and IIS Logs to Claude with MCP

MCP · Web Server Logs to Claude

Ask Claude about your Web Server Logs file, in plain English

Connect Claude, Claude Code, Cursor or any MCP client to Query Streams once. Claude reads the structure of your Web Server Logs file, writes the SQL, runs it read-only through the Agent that already sits with your data, and answers with the rows. No database password ever reaches the AI. About ten minutes, and the Free plan covers it.

About 10 minutes Claude, ChatGPT, Cursor + 11 more clients File stays where it is Read-only, always

What you’ll end up with

A Claude that can answer questions about your nginx, Apache, IIS or Caddy access logs with live, read-only queries over the tables the Agent builds from your files, and tell you which file each answer came from — without ever seeing a login or a file path, and without a firewall change: the Agent already inside your network reads the folder and sends back only the rows. Once the Agent is in place, connecting Claude takes about 90 seconds if you are comfortable with a settings screen. Like this:

Claude · connected to Query Streams Read-only

Show me the latest 5xx errors in the nginx logs.

qs_get_table_schema qs_run_query schema_intelligence

Claude reads the structure of fileset.events first. Then it runs one SELECT through your Agent for status 500 and above, sorted by event_time, newest first.

event_time	path	status
2026-09-25 14:02:11+00	/api/checkout	502
2026-09-25 13:58:47+00	/api/cart/items	504
2026-09-25 13:41:05+00	/search?q=boots	500

Claude sorts by event_time, so requests from rotated files line up in order. Ask a follow-up, such as which client_ip sent most of them.

Where are the 5xx errors coming from? One endpoint, one client, or everywhere?

qs_run_query qs_run_query

I grouped fileset.events by path with a 5xx rate, then bucketed the worst path by 10-minute window:

path	Requests	5xx	Rate
/api/checkout	88,210	1,904	2.2%
/api/cart	142,004	61	0.04%
everything else	2,108,442	88	0.004%

It is one endpoint. All but 40 of the checkout 502s fall in two ten-minute windows, 14:00–14:10 and 16:30–16:40, which line up with the two deploys in the container logs. Between those windows checkout ran clean.

SELECT only, checked by the Agent logged on the MCP Activity tab 6 rows returned across 3 queries

Rather not wire up an AI client at all? On the Business plan, Nova is the assistant built into Query Streams itself. It has every tool Claude gets here, plus the ones Claude does not: it drafts and validates the SQL against your Schema Intelligence model, turns the answer into a chart, and saves the result as a query your team can run from Excel, Google Sheets or the REST API — no key, no connector, nothing to install. Use MCP when your people already live in Claude, Cursor or ChatGPT; use Nova when you want the answers inside the Portal.

Web Server Logs turns nginx logs, Apache access logs, IIS logs and Caddy logs into a table with one row per request, so Claude can answer questions about traffic and errors. There is no server to connect. The Agent reads the log folder on a computer that can open it and caches the rows there. Files are tailed as they grow, and rotated or gzipped files are recognised so no request is counted twice.

What you’ll need

A Query Streams account

MCP is on every plan, including Free. Free allows one key or one connected app, which is all this guide needs. Sign up at my.querystreams.com.

The Agent on a computer that can open the folder

Version 2.6.0 or later. The folder can be on that computer or on a file share it can reach. The Agent runs as a service, so type shares as \\server\share\folder, not as a mapped drive letter. New to the Agent? Install it on Windows, macOS or Linux.

MCP switched on for you

Creators, owners and admins have it from the start. Everyone else needs an admin to flip the MCP switch beside their name under Account → Access Control. Until then the MCP page says “MCP is disabled for your account”.

An AI client

Claude on the web, Claude Desktop or the Claude mobile apps connect with no key. Claude Code, Cursor, ChatGPT and about ten other tools work too; the Portal has a ready-made recipe for each.

Set it up in four steps

1. Point the Agent at the folder

   In the portal open Data → Data Agents, find the Agent that can open the folder and click its Add connector button. Under the Files & Folders pill click the Web Server Logs card. The wizard then walks you through Folders, Check, Settings, Realm and Review:

   Folders

   Type the Root folders, one per line, as paths on the Agent’s computer. Scan subfolders is on, Max depth is 8. Include patterns starts with the right glob for this file type; add Exclude patterns if the folder holds files you do not want. A mapped drive letter shows an amber advisory: the Agent cannot see it, so use the \\server\share path instead.

   Check

   The Agent reads a sample of up to 64 files and shows what it will build. Nothing is created yet. Ready to create means every sampled file fits. An amber banner, “{n} of {m} file(s) will be set aside”, lists files that do not fit with Show which files and why; you can create the connector anyway and fix them later. If the folder mixes layouts, a blue panel offers Switch to one table per layout.

   Settings

   Scan interval (every hour by default, from every 5 minutes to daily) is how often the Agent looks for new, changed and vanished files. Watch folder for changes reacts within seconds on local disks. When a file vanishes is Drop its rows by default.

   Realm, Review

   Pick the Data Realm the rows count against, check the summary and click Create connector. The first scan starts right away; the connector’s Manifest tab shows what it built and any files it set aside.

   • Pick the Log type that matches your server. Columns differ by profile, so use one connector per log format.
   • Only the Custom Log Folder card lets you define your own format. Under the list it says: “Need a log type that is not listed? Open a support request and we add it within a few days.”
   • Table name is optional and defaults to events. Backfill (days) is 30 and Keep events for N days is 60.
   • On Check, the Agent reads a sample and shows the files, size and row estimate. If the files do not match the log type, the headline reads “These files are not” followed by the type. Pick another type and click Test again.

2. See what tables you get

   Requests land in events. The nginx and Apache combined profile gives site, client_ip, auth, method, path, http_version, status, bytes, referrer and agent. The browser string is in agent. IIS W3C logs keep their own names, such as c_ip, cs_uri_stem and sc_status.

   Table	What it holds
   events	One row per request, with event_time, the profile’s columns, _source_file and _line_no.
   events_raw_lines	Lines that did not parse, kept with the line and a reason such as no-grammar-match.
   files	The access log files the Agent reads, with path, size and modified time.
   files_events	File history, including rotated, rewritten and truncated events. Sort by event_at.
   log_cursors	Each file’s read position and state. A set-aside file shows state parked with the reason in last_error.

   Every folder connector also gives Claude the same bookkeeping tables, all in the fileset schema:

   Table	What it holds
   files	Every file currently in the folder: path, name, extension, size, created and modified times. Ask “what is in this folder?” and Claude reads this.
   files_events	The change history: one row per file that appeared, was modified, vanished, or was set aside (drift), with the time in event_at and the reason in detail.
   directories, volumes	Folder sizes and counts, and the disks or shares the roots live on.
   _source_file, _row_id	Two columns on every data row: which file the row came from, and a stable row id inside that file. Group by _source_file to compare files.

3. Connect Claude

   Open Streams → Live → MCP. There are two ways in, and they end at the same place:

   Chat apps · no key

   claude.ai, Claude Desktop, ChatGPT

   In Claude, Query Streams is in the Anthropic Connectors Directory: browse connectors, click Connect. Elsewhere you paste one address into the app, https://mcp.querystreams.com/mcp, and connect from a chat. A Query Streams page opens, you pick the organization and the permissions, and click Approve connection. Nothing to copy, nothing to keep secret. The connection appears under Connected Apps and can be revoked there.

   Developer tools · a key

   Claude Code, Cursor, VS Code and friends

   On My Keys click Generate key. Give it a Key name such as “Claude Code on my laptop”, keep Read and Execute ticked, choose an Expiration (Never, 30 days, 90 days or 1 year) and click Generate key. Copy it, then Continue to install: the Connect tab shows the exact snippet for your tool with the key already filled in.

   Both ways use the same three permissions, which you choose on the consent screen or on the key:

   Read

   List connectors, browse tables and columns, read your saved queries and alert rules. Never returns row data.

   Execute

   Run read-only SQL and saved queries through your Agent and return the rows. Without it Claude can describe your data but not answer from it.

   Analyze

   Profile tables, discover relationships and queue a Schema Intelligence run. It spends Nova AI credits and data allowance, so the consent screen never pre-ticks it.

   Lost the key? Open My Keys: the eye icon shows it again and Copy full key copies it. Revoke it there if a laptop goes missing; every client using it fails on its next call, within about five minutes.

   Then pick the recipe for the Claude you use. The server address is the same everywhere: https://mcp.querystreams.com/mcp.

   Claude on the web, Claude Desktop and mobile no key

   1. Open Settings → Connectors and click Browse connectors. Query Streams is listed in the Anthropic Connectors Directory: find Query Streams and click Connect. (Or open the directory listing directly and click Connect there.)
   2. If your organization hides directory connectors, click Add custom connector instead. Name it Query Streams, paste https://mcp.querystreams.com/mcp, leave the OAuth fields empty, click Add, then in any chat click + → Browse connectors → Query Streams → Connect.
   3. A Query Streams tab opens. Sign in if asked, pick the organization, review Read and Execute, optionally Limit to specific connectors, and click Approve connection.
   4. Back in Claude you see “Connected to Query Streams”. The first time Claude uses a tool it asks; choose Always allow.

   If you do add it by hand in Claude Desktop, use Settings → Connectors → Add, not the in-chat Add marketplace option, which expects a git repository. Connectors sync to your Claude account, so the mobile apps and Desktop pick it up automatically. Menu names are Anthropic’s and can move.

   Claude Code key

   One command, with your key from My Keys:

   Terminal

   claude mcp add --transport http querystreams https://mcp.querystreams.com/mcp \
     --header "X-MCP-Key: qsmcp_PASTE_YOUR_KEY_HERE"

   That writes the current project’s .mcp.json. Add --scope user to have Query Streams in every project. Run /mcp inside Claude Code to see it connected.

   Cursor key

   Open Cursor Settings → MCP → Add New MCP Server, or edit .cursor/mcp.json at the root of your workspace:

   .cursor/mcp.json

   {
     "mcpServers": {
       "querystreams": {
         "url": "https://mcp.querystreams.com/mcp",
         "headers": {
           "X-MCP-Key": "qsmcp_PASTE_YOUR_KEY_HERE"
         }
       }
     }
   }

   Restart Cursor or run MCP: Restart Servers; a querystreams badge appears in the MCP status bar.

   Using something else? The Connect tab has ready-to-paste recipes for ChatGPT, VS Code, Visual Studio, OpenAI Codex CLI, Gemini CLI, Windsurf, Zed, Cline, Continue.dev and JetBrains AI, plus a Paste & merge tool that drops the querystreams entry into a config file you already have. Any client that speaks MCP over HTTP works: server https://mcp.querystreams.com/mcp, header X-MCP-Key (an Authorization: Bearer header with the same key also works).

4. Ask your first question

   Start with something you can check by opening the folder, so you see Claude reach for the right table. Three that work well with your nginx, Apache, IIS or Caddy access logs:

   “Which access log files is the Agent reading, and which rotated this week?”

   Claude lists fileset.files and the rotated rows in files_events, newest event_at first.

   “What are the top 20 paths returning 404 in the last 7 days?”

   Claude filters events on status and event_time, groups by path and returns counts.

   “Were any log lines left unparsed, and why?”

   Claude counts rows in events_raw_lines by reason and shows example lines.

   To confirm the wiring, ask “What Query Streams connectors do I have?”. Claude calls qs_list_connectors, and on My Keys the key’s Last used time updates within a few seconds.

How new, changed and deleted files show up

What Claude can do once connected

Claude sees nineteen small tools. You never call them yourself; Claude picks the right one for your question. In plain terms:

Why Schema Intelligence matters here

Every answer Claude receives is tagged with where the structure came from, and Claude adjusts how much it trusts what it sees.

If a database matters, run Schema Intelligence on it once from Nova → Intelligence. The My Keys tab shows a coverage panel per connector. How Schema Intelligence works.

What the plans allow

MCP is on every plan, including Free, with no separate fee. What each plan sets is how many keys or connected apps you can hold and how many calls a minute Claude may make:

A connected app counts as a key. On top of the per-minute figure, any one key may run at most 10 queries a minute. A query returns up to 1,000 rows and runs for up to 60 seconds unless Claude asks for more, to a ceiling of 50,000 rows and five minutes. The rows Claude receives count against your Data Realm allowance, the same pool your Excel and Sheets queries use, and MCP is measured before compression, so a wide result costs more here than the same rows in a spreadsheet. Schema Intelligence runs started from Claude spend Nova AI credits, exactly as they do from the Portal. See the pricing page for the allowances.

Keeping it safe

Good next moves

• Run Schema Intelligence on the connector so Claude gets plain-English descriptions of your own columns. The file tables already carry built-in descriptions.
• Shorten the Scan interval for fresher traffic answers. The default is every hour, and every 5 minutes is the shortest option.
• Open the connector’s Files dialog to see each log file and why any is set aside. In the connector list, this connector shows as Log Files.

When something doesn’t work

Questions people ask

Related guides

• Connect a Folder of CSV Files to Claude with MCP
• Connect a Folder of Excel Files to Claude with MCP
• Connect a Folder of SQLite Databases to Claude with MCP
• Connect a Folder of Parquet Files to Claude with MCP
• Connect Query Streams to Claude via MCP: setup, permissions and troubleshooting
• All MCP guides