Owl CLI Tool Inventory¶
This document introduces the business tool capabilities that can be directly executed by the Owl CLI, including tool scope, permission types, CLI usage conventions, tool overview, and tool descriptions categorized by type.
The visibility and execution results of tools depend on the permissions of the API Key corresponding to the current OWL_TOKEN. If the API Key lacks the necessary resource or operation permissions, the corresponding tool may fail to execute or return empty results.
Note
This document only describes business tools that can be directly invoked via owl exec. It does not include CLI commands themselves, such as owl init, owl login, owl sync, owl list, owl show, owl data list, etc.
Tool Scope¶
The tools exposed by Owl CLI will be continuously updated along with platform capabilities. The actual visible tools are subject to the tool directory returned by owl list after completing owl sync locally.
The current document covers the following business categories:
| Category | Description |
|---|---|
catalog |
Unified Resource Catalog, entity types, entity details, and topology relationships |
dashboard |
Dashboard creation, replacement, and detail retrieval |
data |
DQL namespace exploration, Log/Metrics/RUM/APM/Network/Profile/Billing data discovery, DQL documentation query, DQL validation, full query execution, and Profiling parsing |
errors |
Error center issue query and comment management |
event |
Event list query and event detail retrieval |
incident |
Incident list, incident comments, operation records, and on-call schedules |
infrastructure |
Unified catalog resource query |
llm |
LLM observable application list query |
member |
Workspace member query |
monitor |
Monitor query, creation, update, and external event reception |
pipeline |
Pipeline list query and sample validation |
Permission Types¶
| Permission Type | Meaning | Usage Suggestion |
|---|---|---|
| Read-only | Operations that do not modify workspace resources, such as queries, listing, detail retrieval, sample validation, etc. | Suitable for daily troubleshooting and automated read-only execution |
| Write | Operations that modify workspace resources, such as creation, updates, appending comments, receiving external events, etc. | It is recommended to confirm parameters and impact scope before use in production environments |
| Local Assistant | Local auxiliary capabilities that do not modify workspace resources, such as local DQL documentation retrieval, local syntax validation, etc. | Suitable for use before formally executing queries |
CLI Usage Conventions¶
| Type | Convention |
|---|---|
| Tool Synchronization | Execute owl sync first upon initial use or after platform tool updates |
| Category & Tool Browsing | Use owl category list, owl list, owl list -c <category> to browse the tool directory |
| View Tool Definition | Before execution, it is recommended to use owl show <tool name> to view parameter definitions |
| Tool Execution | Use owl exec <tool name> [parameters] uniformly to execute tools |
| Parameter Passing | Supports four methods: --key value, key=value, -p '<json>', --stdin |
| Time Range | Use 13-digit millisecond timestamps uniformly |
| Pagination Parameters | Typically use page_size and page_index |
| Detail Query | Usually relies on identifiers like UUID, ID, URN returned by list tools for further queries |
| Data Query | It is recommended to first call discovery tools to obtain source, field, tag, index, then execute the formal query |
| Data Result Files | When the tool output type is data, results are automatically written to the local data directory and can be viewed with owl data list, owl data show <file-id> |
Common CLI Command Examples:
owl sync
owl list
owl list -c data
owl show owl.data.query
owl exec owl.metric.list --mode source
owl exec owl.event.list --start_time 1712505600000 --end_time 1712592000000 --limit 20
Tool Overview¶
| Tool Set | Tool | Function | Permission |
|---|---|---|---|
catalog |
owl.catalog.entity_type_query |
Query entity types supported by the unified catalog | Read-only |
catalog |
owl.catalog.entity_query |
Query entity list by entity type | Read-only |
catalog |
owl.catalog.entity_get |
Get details of a single entity by urn |
Read-only |
catalog |
owl.catalog.entity_topology_query |
Query topology relationships associated with a single entity | Read-only |
catalog |
owl.catalog.all_topology_query |
Query global topology grouping results | Read-only |
dashboard |
owl.dashboard.create |
Create a dashboard | Write |
dashboard |
owl.dashboard.replace |
Replace content of an existing dashboard | Write |
dashboard |
owl.dashboard.get |
Get dashboard details | Read-only |
data |
owl.data.show_dql_namespace |
View DQL namespace list and whether index is supported |
Read-only |
data |
owl.data.query |
Execute full DQL or PromQL query | Read-only |
data |
owl.data.search_dql_docs |
Query locally synchronized DQL documentation and example snippets | Local Assistant |
data |
owl.data.check_dql |
Validate candidate DQL statement syntax | Local Assistant |
data |
owl.metric.list |
Discover source, field, or tag keys available for metric queries |
Read-only |
data |
owl.rum.list |
Discover source or fields available for RUM queries |
Read-only |
data |
owl.apm.list |
Discover source or fields available for APM queries |
Read-only |
data |
owl.network.list |
Discover source or fields available for Network queries |
Read-only |
data |
owl.profile.list |
Discover source or fields available for Profile queries |
Read-only |
data |
owl.logging.list |
Discover source or fields available for logging queries |
Read-only |
data |
owl.billing.list |
Discover source or fields available for Billing queries |
Read-only |
data |
owl.log_index.list |
List indexes available for logging queries | Read-only |
data |
owl.log_index.get |
Query details of a single log index | Read-only |
data |
owl.field_schema.get |
Query current field catalog for query field completion | Read-only |
data |
owl.profiling.get_summary |
Query summary information of a Profiling record | Read-only |
data |
owl.profiling.parse |
Parse detailed content of a Profiling record | Read-only |
errors |
owl.errors.list |
Query error center issue list | Read-only |
errors |
owl.errors.comment.add |
Add a comment to an error issue | Write |
errors |
owl.errors.comment.list |
Query comment list for an error issue | Read-only |
errors |
owl.errors.comment.update |
Update an existing error comment | Write |
event |
owl.event.list |
Query event list | Read-only |
event |
owl.event.get |
Query details of a single event | Read-only |
incident |
owl.incident.list |
Query incident list | Read-only |
incident |
owl.incident_comment.list |
Query incident comment list | Read-only |
incident |
owl.incident_comment.add |
Add a comment to an incident ticket | Write |
incident |
owl.incident_operation.list |
Query incident operation records | Read-only |
incident |
owl.incident_schedule.list |
Query on-call schedule list | Read-only |
incident |
owl.incident_schedule.get |
Query on-call schedule details | Read-only |
infrastructure |
owl.infrastructure.list |
Query infrastructure object list | Read-only |
infrastructure |
owl.infrastructure.get |
Query details of a single infrastructure object | Read-only |
llm |
owl.llm.list |
Query LLM application list | Read-only |
member |
owl.member.list |
Query workspace member list | Read-only |
monitor |
owl.monitor.list |
Query monitor list | Read-only |
monitor |
owl.monitor.get |
Query monitor details | Read-only |
monitor |
owl.monitor.upsert |
Create or update a monitor | Write |
monitor |
owl.monitor.receive |
Send external events | Write |
pipeline |
owl.pipeline.list |
Query Pipeline list | Read-only |
pipeline |
owl.pipeline.validate |
Validate Pipeline processing results with sample data | Read-only |
Catalog¶
Used for entity type discovery, entity query, entity detail retrieval, and topology relationship query in the unified resource catalog.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.catalog.entity_type_query |
Query entity types supported by the unified catalog | List entity types currently supported by Catalog | page_size, page_index |
Read-only |
owl.catalog.entity_query |
Query entity list by entity type | Query Catalog entity list of type host |
entity_type, page_size, page_index |
Read-only |
owl.catalog.entity_get |
Get details of a single entity by urn |
Query details of the entity corresponding to this urn |
urn |
Read-only |
owl.catalog.entity_topology_query |
Query topology relationships associated with a single entity | View upstream/downstream topology of this host entity | urn |
Read-only |
owl.catalog.all_topology_query |
Query global topology grouping results | Query the global topology structure of the current unified catalog | None | Read-only |
Dashboard¶
Used for dashboard creation, replacement, and detail retrieval.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.dashboard.create |
Create a dashboard | Create a dashboard named "APM Overview" | name, dashboard_json |
Write |
owl.dashboard.replace |
Replace content of an existing dashboard | Replace the specified dashboard with new dashboard_json |
dashboard_uuid, dashboard_json |
Write |
owl.dashboard.get |
Get dashboard details | Query the full configuration corresponding to this dashboard UUID | dashboard_uuid |
Read-only |
Data¶
Used for full data query and query assistance, covering data domains such as Log, Metrics, RUM, APM, Network, Profile, Billing, etc.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.data.show_dql_namespace |
List currently supported DQL namespaces and indicate whether index is supported |
View which DQL namespaces are currently supported | None | Read-only |
owl.data.query |
Execute full DQL or PromQL query | Query 500 errors in nginx logs from the last 1 hour | dql_namespace, start_time, end_time, query_mode, query_text, source, select, index |
Read-only |
owl.data.search_dql_docs |
Query locally synchronized DQL documentation and example snippets | Search for the syntax of percentile in DQL |
query, refresh_docs, limit |
Local Assistant |
owl.data.check_dql |
Validate candidate DQL statement syntax | Validate if a handwritten DQL is correct | query_text |
Local Assistant |
owl.metric.list |
Discover source, field, or tag keys available for metric queries |
List available measurements or tags in the metric domain | mode, source |
Read-only |
owl.rum.list |
Discover source or fields available for RUM queries |
List available fields in the RUM domain | mode, source |
Read-only |
owl.apm.list |
Discover source or fields available for APM queries |
Query available sources in the APM domain | mode, source |
Read-only |
owl.network.list |
Discover source or fields available for Network queries |
List available fields in the Network domain | mode, source |
Read-only |
owl.profile.list |
Discover source or fields available for Profile queries |
View available sources in the Profile domain | mode, source |
Read-only |
owl.logging.list |
Discover source or fields available for logging queries |
List available sources in the logging domain | mode, source |
Read-only |
owl.billing.list |
Discover source or fields available for Billing queries |
List available fields in the Billing domain | mode, source |
Read-only |
owl.log_index.list |
List indexes available for logging queries | List current log indexes | None | Read-only |
owl.log_index.get |
Query details of a single log index | Query details of this log index UUID | index_uuid |
Read-only |
owl.field_schema.get |
Query current field catalog for query field completion | List current available field catalog | None | Read-only |
owl.profiling.get_summary |
Query summary information of a Profiling record | View summary information for this profile_id |
profile_id, timeRange |
Read-only |
owl.profiling.parse |
Parse detailed content of a Profiling record | Parse detailed stack information of this Profiling record | profile_id, language, type, profile_start, profile_end |
Read-only |
Errors¶
Used for error center issue list query, and comment addition, query, and update.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.errors.list |
Query error center issue list | Query error issue list from the last 24 hours | start_time, end_time, page_size, page_index, conditions, assigner, issue_status |
Read-only |
owl.errors.comment.add |
Add a comment to an error issue | Add a troubleshooting comment to this error issue | issue_id, comment, attachment_uuids, extend |
Write |
owl.errors.comment.list |
Query comment list for an error issue | View comment records for this error issue | issue_id, page_size, page_index |
Read-only |
owl.errors.comment.update |
Update an existing error comment | Update the content of this error comment | comment_uuid, comment, attachment_uuids, extend |
Write |
Event¶
Used for event center list query and event detail retrieval.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.event.list |
Query event list | Query critical events from the last 1 hour | start_time, end_time, status, limit |
Read-only |
owl.event.get |
Query details of a single event | Query details of this event doc_id |
doc_id |
Read-only |
Incident¶
Used for incident list, incident comments, operation records, and on-call schedule query.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.incident.list |
Query incident list | Query all current incident tickets | search, page_size, page_index |
Read-only |
owl.incident_comment.list |
Query incident comment list | View comment records for this incident ticket | incident_uuid |
Read-only |
owl.incident_comment.add |
Add a comment to an incident ticket | Add a processing progress note to this incident ticket | incident_uuid, comment |
Write |
owl.incident_operation.list |
Query incident operation records | View operation history for this incident ticket | incident_uuid, page_size, page_index |
Read-only |
owl.incident_schedule.list |
Query on-call schedule list | Query current on-call schedule list | search, page_size, page_index |
Read-only |
owl.incident_schedule.get |
Query on-call schedule details | Query detailed configuration of this on-call schedule | schedule_uuid |
Read-only |
Infrastructure¶
Used for infrastructure object list and detail query, covering resource objects such as hosts, containers, processes, etc.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.infrastructure.list |
Query infrastructure object list | Query all current host objects | resource_type, limit, filters |
Read-only |
owl.infrastructure.get |
Query details of a single infrastructure object | Query detailed information of this container object | resource_type, identity_value |
Read-only |
LLM¶
Used for LLM observable application list query.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.llm.list |
Query LLM application list | List all current LLM applications | search, type, page_size, page_index |
Read-only |
Member¶
Used for workspace member list query and retrieval by name or email keyword.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.member.list |
Query workspace member list | Search for members whose email contains alice |
search |
Read-only |
Monitor¶
Used for monitor list query, detail retrieval, creation or update, and external event reception.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.monitor.list |
Query monitor list | Query currently enabled monitors | search, status_list |
Read-only |
owl.monitor.get |
Query monitor details | Query the full configuration of this monitor rule | rule_uuid |
Read-only |
owl.monitor.upsert |
Create a monitor or update an existing monitor | Create a new external event monitor | json_script, rule_uuid, status, secret, alert_policy_uuids, tags |
Write |
owl.monitor.receive |
Send external events to the receiver | Send a test event to this monitor | event, target, monitor, extra_data |
Write |
Pipeline¶
Used for Pipeline list query and sample validation.
| Tool Name | Function | Example Use Case | Key Parameters | Permission |
|---|---|---|---|---|
owl.pipeline.list |
Query Pipeline list and return decoded content | List Pipelines whose names contain nginx | search, scope, categories |
Read-only |
owl.pipeline.validate |
Validate Pipeline processing results with sample data | Use this log sample to validate if this Pipeline can parse correctly | content, testData, dataType |
Read-only |
CLI Usage Paths¶
Data Query Problems¶
Applicable to problems like "querying Metrics, Log, RUM, APM, Network, Profile, Billing data".
- First execute
owl.data.show_dql_namespaceto confirm the target namespace. -
Call discovery tools by data domain:
- Metrics:
owl.metric.list - RUM:
owl.rum.list - APM:
owl.apm.list - Network:
owl.network.list - Profile:
owl.profile.list - Logging:
owl.logging.list - Billing:
owl.billing.list - Log Index:
owl.log_index.list - Field Catalog:
owl.field_schema.get
- Metrics:
-
When DQL syntax confirmation is needed, first call
owl.data.search_dql_docsto search documentation. - After writing the full DQL manually, first call
owl.data.check_dqlfor local validation. - Finally, call
owl.data.queryto execute the formal query.
Profiling Analysis Problems¶
Applicable to problems like "already have a profile_id, want to view summary or parse detailed stack information".
- First locate the target
profile_idin the Profiling data domain viaowl.data.query. - Call
owl.profiling.get_summaryto get summary information. - Reuse
language,type,profile_start,profile_endfrom the summary result, then callowl.profiling.parseto parse detailed content.
Incident Troubleshooting Problems¶
Applicable to problems like "query incident tickets, track processing progress, add comments".
- First call
owl.incident.listto query incident tickets. -
Based on
incident_uuid, continue calling:owl.incident_comment.listto view commentsowl.incident_operation.listto view operation records- When processing progress needs to be added, call
owl.incident_comment.add.
Dashboard Management Problems¶
Applicable to problems like "creating dashboards, replacing dashboard content, viewing existing dashboard configurations".
- Call
owl.dashboard.createwhen creating a new dashboard. - Call
owl.dashboard.replacewhen replacing an existing dashboard. - Call
owl.dashboard.getwhen needing to view current configuration.
Monitor Management Problems¶
Applicable to problems like "viewing monitors, creating monitors, updating monitors, sending test events".
- First call
owl.monitor.listto browse target monitors. - Call
owl.monitor.getwhen details are needed. - Call
owl.monitor.upsertwhen creating or updating. - Call
owl.monitor.receivewhen needing to send external events to verify the reception pipeline.