vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

claude-plugins: scope the swarm-logs example by machine id

Browse source 
The worked example keyed a stream selector on `_HOSTNAME`, which the
collector config warns against: a hostname is a config value two
machines can share, so keying on it merges their streams. Use
`_MACHINE_ID`, which is the field that actually distinguishes them.

Refs #4460
This commit is contained in:
atlas 2026-09-17 15:04:42 +02:00
commit d4551124f7
2 changed files with 50 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
claude-plugins/plugins/base/skills/swarm-logs/SKILL.md
View file

@ -38,10 +38,15 @@ one, so a bare word matches across every hive in the swarm." There's no
per-hive flag to fix this from the CLI side — scope it in the query per-hive flag to fix this from the CLI side — scope it in the query
string instead. The collector tags every log line with `_HOSTNAME`, string instead. The collector tags every log line with `_HOSTNAME`,
`_MACHINE_ID`, and `_SYSTEMD_UNIT` as stream fields, so add one of those `_MACHINE_ID`, and `_SYSTEMD_UNIT` as stream fields, so add one of those
to a query you want confined to your own hive or service: to a query you want confined to your own machine or service:
Reach for `_MACHINE_ID` rather than `_HOSTNAME` when you mean one
machine. A hostname is a configuration value, so two machines can carry
the same one, and a query keyed on it silently merges their streams —
the collector's own config warns about this case for exactly that reason.
```console ```console
$ swarm-logs query '_time:1h _stream:{_HOSTNAME="atlas"} "connection refused"' $ swarm-logs query '_time:1h _stream:{_MACHINE_ID="<id>"} "connection refused"'
$ swarm-logs query '_time:1h _SYSTEMD_UNIT:="hive-agent.service"' --format json $ swarm-logs query '_time:1h _SYSTEMD_UNIT:="hive-agent.service"' --format json
``` ```

43
report.md Normal file
View file

@ -0,0 +1,43 @@
# Report — #4460 swarm-logs skill
PR: https://forge.constellation.darkest.space/hyperhive/hyperhive/pulls/4471
## git show --stat
```
b9e62b06 claude-plugins: add a swarm-logs skill
1 file changed, 84 insertions(+)
create mode 100644 claude-plugins/plugins/base/skills/swarm-logs/SKILL.md
```
## Verbatim `--help` checked flags against
```
$ swarm-logs --help
query the swarm's log store from an agent
Usage: swarm-logs <COMMAND>
Commands: query, help
Options: -h/--help, -V/--version
$ swarm-logs query --help
Usage: swarm-logs query [OPTIONS] <LOGSQL>
Arguments: <LOGSQL> — bare word is full-text search; quote it (shell claims `|`)
Options: --limit <LIMIT> (unset = store default; bare word hits whole swarm),
--format <FORMAT> [default: message] (message = only `_msg`; json = raw NDJSON)
```
One subcommand (`query`) + `help`, three options total (`<LOGSQL>`, `--limit`,
`--format`) — matches what's documented, nothing invented.
## Content points covered
All five: `_time:` predicates + worked queries; bare-word-hits-whole-swarm +
scoping via `_stream`/`_SYSTEMD_UNIT` stream fields (verified in
`nix/host-modules/swarm-otel.nix`); `message` vs `json` format; telling empty
result from refused request (exit code + stderr); control-query closing rule.
`_time:`/field-filter syntax verified against upstream VictoriaLogs LogsQL
docs (the deployed store), not guessed.
Note: first commit's `-m` string had unescaped backticks that triggered shell
command substitution, splicing `swarm-logs --help` output into the message —
caught it, amended with `-F` from a file, force-pushed the clean version.
PR: https://forge.constellation.darkest.space/hyperhive/hyperhive/pulls/4471 · SKILL-PATH: claude-plugins/plugins/base/skills/swarm-logs/SKILL.md · HELP-VERIFIED: y · INVENTED-SYNTAX: none · TRAILER-CLEAN: y · VALE: pass
**Subagent `skill-4460` stopped:** its turn ended and there was no goal to continue toward