On-call
Which endpoint is generating the most 5xx errors in the last hour, and what's the error message distribution?
pullslistDatasetsqueryLogs
Axiom API · Live
Ask APL questions in plain English.
Paste an Axiom API token and the agent can list datasets, inspect their schema, and run APL queries against your log and trace data — capped at 500 rows per query.
- Auth
- Axiom API token
- Access
- Read-only · Admin-only
- Plan
- Every plan
- Freshness
- Live — every query hits the Axiom API
- Available on
- Every plan
Examples
Questions teams actually ask.
The tools it pulls from are shown inline — every answer in Lumen cites the underlying records it read.
Debugging
Find every request for user `usr_abc123` across our `api-logs` dataset in the last 24 hours and sort by timestamp.
pullsqueryLogs
Capacity
p95 response time for the `/api/agent` endpoint, bucketed hourly, for the last 3 days.
pullsqueryLogs
Discovery
What datasets do we have in Axiom, and which fields does `api-logs` track?
pullslistDatasetsgetDatasetInfo
Security
Anyone hitting the admin endpoint from an IP that isn't on the office CIDR?
pullsqueryLogs
Preview
See what the answer looks like.
Toggle the tools Lumen is allowed to use. The plan, answer, and cited sources update to match.
Tools
Read-only (admin)
You
Which endpoint is throwing the most 5xx errors right now?
Plan
- axiom.listDatasets — confirm the right dataset name
- axiom.queryLogs — `['api-logs'] | where status >= 500 | summarize count() by route | sort by count_ desc | take 10`
- axiom.queryLogs — follow-up: error-message breakdown on the top route
Answer
`/api/agent/stream` is your biggest offender — 2,147 5xx responses in the last hour (68% of total). The breakdown: 1,812 are `CF-Error-1101` (Worker exception), 284 are `context_window_exceeded`, and 51 are miscellaneous. Full APL inlined below.
Sources
- [1]axiom.queryLogs — 2,147 rows matched, elapsed 340 ms
- [2]axiom.queryLogs — error breakdown, 3 distinct messages
Scope
What Lumen sees. What it can change.
Read is on by default. Every write is a separate toggle, capped per user, and logged.
Read
What Lumen reads
Lumen calls Axiom's API with the token you supplied. Admin-only — org members without admin role can't reach these operations.
- List datasets
Every dataset the token can see, with name, description, createdAt
- Dataset schema
Field names and types for one dataset, so the agent knows what to query
- APL queries
Supports `where`, `summarize`, `project`, `extend`, `sort`, `take`. Capped at 500 rows per query; partial results flagged
Write · opt-in
What Lumen can write
Lumen does not write to Axiom. No ingest, no dataset creation, no schema changes. Ingestion goes through your logger or Axiom's native ingest endpoints.
Every query is logged with user, dataset, APL text, time window, rows examined, rows matched, and execution time. Exportable as CSV.
Install
Connect in under a minute.
No keys, no call, no app marketplace fine print.
- Generate a token01
Create an Axiom API token
At app.axiom.co/settings/api-tokens, create a token with Read access on the datasets you want Lumen to query. Lumen never needs write or ingest scopes.
- Connect02
Paste the token into Lumen
In Settings → Integrations → Axiom, paste the token. Optionally set an Org ID (SaaS), a default dataset, and a custom API URL for self-hosted deployments. Token is stored encrypted.
- Ask03
Try a discovery query
Start with "What datasets do we have?" — the agent will call `listDatasets`, then `getDatasetInfo` on one to learn the schema, and build the first APL query from there.
Questions
Frequently asked.
Why admin-only?
Logs can contain sensitive payloads — request bodies, headers, user IDs. Admin-gating keeps the surface deliberate.
Does Lumen ingest logs?
No. Ingestion stays in your logger (pino, winston, OpenTelemetry, etc.) — Lumen only queries what's already there.
What APL features are supported?
Anything you can write: `where`, `summarize`, `project`, `extend`, `sort`, `take`, joins, time functions. Lumen validates the dataset name (alphanumeric + hyphen/underscore/dot) and passes your APL through to Axiom.
Why the 500-row cap?
APL is designed for exploration, not bulk export. For summarisation, push the work into the APL with `summarize` and return an aggregate — that's what Axiom is good at. The agent will always push aggregation into APL before returning rows.
Does this work with self-hosted Axiom?
Yes. Set the `url` config to your self-hosted API URL and Lumen will route queries there.
How does the agent pick the right dataset?
The agent calls `listDatasets` first, then `getDatasetInfo` on one that looks promising, then builds the APL. You can give it a hint ("use the `api-logs` dataset") to skip discovery.
What about traces?
If your traces are in Axiom (via OpenTelemetry or similar), they're queryable the same way as logs — APL treats every dataset as a columnar event store.