diff --git a/claude-plugins/plugins/base/skills/swarm-logs/SKILL.md b/claude-plugins/plugins/base/skills/swarm-logs/SKILL.md index e8c5d20d..22f7fe09 100644 --- a/claude-plugins/plugins/base/skills/swarm-logs/SKILL.md +++ b/claude-plugins/plugins/base/skills/swarm-logs/SKILL.md @@ -38,7 +38,7 @@ one, so a bare word matches across every hive in the swarm." There's no per-hive flag to fix this from the CLI side — scope it in the query string instead. The collector tags every log line with `_HOSTNAME`, `_MACHINE_ID`, and `_SYSTEMD_UNIT` as stream fields, so add one of those -to a query you want confined to your own machine or service: +to a query you want confined to your own machine or service. Reach for `_MACHINE_ID` rather than `_HOSTNAME` when you mean one machine. A hostname is a configuration value, so two machines can carry @@ -80,7 +80,7 @@ tooling or auth problem to fix, not a log finding to report. ## Before you believe an empty result, run a control -An empty result *looks* like proof of absence, but it's just as +An empty result _looks_ like proof of absence, but it's just as consistent with a `_time:` window that missed the event, a scoping field that doesn't match what you expected, or a typo in the search term. Before reporting "no matching logs," run a second query you know must return