Skip to content

Owl CLI Tool Inventory


This document introduces the business tool capabilities that can be directly executed by the Owl CLI, including tool scope, permission types, CLI usage conventions, tool overview, and tool descriptions categorized by type.

The visibility and execution results of tools depend on the permissions of the API Key corresponding to the current OWL_TOKEN. If the API Key lacks the necessary resource or operation permissions, the corresponding tool may fail to execute or return empty results.

Note

This document only describes business tools that can be directly invoked via owl exec. It does not include CLI commands themselves, such as owl init, owl login, owl sync, owl list, owl show, owl data list, etc.

Tool Scope

The tools exposed by Owl CLI will be continuously updated along with platform capabilities. The actual visible tools are subject to the tool directory returned by owl list after completing owl sync locally.

The current document covers the following business categories:

Category Description
catalog Unified Resource Catalog, entity types, entity details, and topology relationships
dashboard Dashboard creation, replacement, and detail retrieval
data DQL namespace exploration, Log/Metrics/RUM/APM/Network/Profile/Billing data discovery, DQL documentation query, DQL validation, full query execution, and Profiling parsing
errors Error center issue query and comment management
event Event list query and event detail retrieval
incident Incident list, incident comments, operation records, and on-call schedules
infrastructure Unified catalog resource query
llm LLM observable application list query
member Workspace member query
monitor Monitor query, creation, update, and external event reception
pipeline Pipeline list query and sample validation

Permission Types

Permission Type Meaning Usage Suggestion
Read-only Operations that do not modify workspace resources, such as queries, listing, detail retrieval, sample validation, etc. Suitable for daily troubleshooting and automated read-only execution
Write Operations that modify workspace resources, such as creation, updates, appending comments, receiving external events, etc. It is recommended to confirm parameters and impact scope before use in production environments
Local Assistant Local auxiliary capabilities that do not modify workspace resources, such as local DQL documentation retrieval, local syntax validation, etc. Suitable for use before formally executing queries

CLI Usage Conventions

Type Convention
Tool Synchronization Execute owl sync first upon initial use or after platform tool updates
Category & Tool Browsing Use owl category list, owl list, owl list -c <category> to browse the tool directory
View Tool Definition Before execution, it is recommended to use owl show <tool name> to view parameter definitions
Tool Execution Use owl exec <tool name> [parameters] uniformly to execute tools
Parameter Passing Supports four methods: --key value, key=value, -p '<json>', --stdin
Time Range Use 13-digit millisecond timestamps uniformly
Pagination Parameters Typically use page_size and page_index
Detail Query Usually relies on identifiers like UUID, ID, URN returned by list tools for further queries
Data Query It is recommended to first call discovery tools to obtain source, field, tag, index, then execute the formal query
Data Result Files When the tool output type is data, results are automatically written to the local data directory and can be viewed with owl data list, owl data show <file-id>

Common CLI Command Examples:

owl sync
owl list
owl list -c data
owl show owl.data.query
owl exec owl.metric.list --mode source
owl exec owl.event.list --start_time 1712505600000 --end_time 1712592000000 --limit 20

Tool Overview

Tool Set Tool Function Permission
catalog owl.catalog.entity_type_query Query entity types supported by the unified catalog Read-only
catalog owl.catalog.entity_query Query entity list by entity type Read-only
catalog owl.catalog.entity_get Get details of a single entity by urn Read-only
catalog owl.catalog.entity_topology_query Query topology relationships associated with a single entity Read-only
catalog owl.catalog.all_topology_query Query global topology grouping results Read-only
dashboard owl.dashboard.create Create a dashboard Write
dashboard owl.dashboard.replace Replace content of an existing dashboard Write
dashboard owl.dashboard.get Get dashboard details Read-only
data owl.data.show_dql_namespace View DQL namespace list and whether index is supported Read-only
data owl.data.query Execute full DQL or PromQL query Read-only
data owl.data.search_dql_docs Query locally synchronized DQL documentation and example snippets Local Assistant
data owl.data.check_dql Validate candidate DQL statement syntax Local Assistant
data owl.metric.list Discover source, field, or tag keys available for metric queries Read-only
data owl.rum.list Discover source or fields available for RUM queries Read-only
data owl.apm.list Discover source or fields available for APM queries Read-only
data owl.network.list Discover source or fields available for Network queries Read-only
data owl.profile.list Discover source or fields available for Profile queries Read-only
data owl.logging.list Discover source or fields available for logging queries Read-only
data owl.billing.list Discover source or fields available for Billing queries Read-only
data owl.log_index.list List indexes available for logging queries Read-only
data owl.log_index.get Query details of a single log index Read-only
data owl.field_schema.get Query current field catalog for query field completion Read-only
data owl.profiling.get_summary Query summary information of a Profiling record Read-only
data owl.profiling.parse Parse detailed content of a Profiling record Read-only
errors owl.errors.list Query error center issue list Read-only
errors owl.errors.comment.add Add a comment to an error issue Write
errors owl.errors.comment.list Query comment list for an error issue Read-only
errors owl.errors.comment.update Update an existing error comment Write
event owl.event.list Query event list Read-only
event owl.event.get Query details of a single event Read-only
incident owl.incident.list Query incident list Read-only
incident owl.incident_comment.list Query incident comment list Read-only
incident owl.incident_comment.add Add a comment to an incident ticket Write
incident owl.incident_operation.list Query incident operation records Read-only
incident owl.incident_schedule.list Query on-call schedule list Read-only
incident owl.incident_schedule.get Query on-call schedule details Read-only
infrastructure owl.infrastructure.list Query infrastructure object list Read-only
infrastructure owl.infrastructure.get Query details of a single infrastructure object Read-only
llm owl.llm.list Query LLM application list Read-only
member owl.member.list Query workspace member list Read-only
monitor owl.monitor.list Query monitor list Read-only
monitor owl.monitor.get Query monitor details Read-only
monitor owl.monitor.upsert Create or update a monitor Write
monitor owl.monitor.receive Send external events Write
pipeline owl.pipeline.list Query Pipeline list Read-only
pipeline owl.pipeline.validate Validate Pipeline processing results with sample data Read-only

Catalog

Used for entity type discovery, entity query, entity detail retrieval, and topology relationship query in the unified resource catalog.

Tool Name Function Example Use Case Key Parameters Permission
owl.catalog.entity_type_query Query entity types supported by the unified catalog List entity types currently supported by Catalog page_size, page_index Read-only
owl.catalog.entity_query Query entity list by entity type Query Catalog entity list of type host entity_type, page_size, page_index Read-only
owl.catalog.entity_get Get details of a single entity by urn Query details of the entity corresponding to this urn urn Read-only
owl.catalog.entity_topology_query Query topology relationships associated with a single entity View upstream/downstream topology of this host entity urn Read-only
owl.catalog.all_topology_query Query global topology grouping results Query the global topology structure of the current unified catalog None Read-only

Dashboard

Used for dashboard creation, replacement, and detail retrieval.

Tool Name Function Example Use Case Key Parameters Permission
owl.dashboard.create Create a dashboard Create a dashboard named "APM Overview" name, dashboard_json Write
owl.dashboard.replace Replace content of an existing dashboard Replace the specified dashboard with new dashboard_json dashboard_uuid, dashboard_json Write
owl.dashboard.get Get dashboard details Query the full configuration corresponding to this dashboard UUID dashboard_uuid Read-only

Data

Used for full data query and query assistance, covering data domains such as Log, Metrics, RUM, APM, Network, Profile, Billing, etc.

Tool Name Function Example Use Case Key Parameters Permission
owl.data.show_dql_namespace List currently supported DQL namespaces and indicate whether index is supported View which DQL namespaces are currently supported None Read-only
owl.data.query Execute full DQL or PromQL query Query 500 errors in nginx logs from the last 1 hour dql_namespace, start_time, end_time, query_mode, query_text, source, select, index Read-only
owl.data.search_dql_docs Query locally synchronized DQL documentation and example snippets Search for the syntax of percentile in DQL query, refresh_docs, limit Local Assistant
owl.data.check_dql Validate candidate DQL statement syntax Validate if a handwritten DQL is correct query_text Local Assistant
owl.metric.list Discover source, field, or tag keys available for metric queries List available measurements or tags in the metric domain mode, source Read-only
owl.rum.list Discover source or fields available for RUM queries List available fields in the RUM domain mode, source Read-only
owl.apm.list Discover source or fields available for APM queries Query available sources in the APM domain mode, source Read-only
owl.network.list Discover source or fields available for Network queries List available fields in the Network domain mode, source Read-only
owl.profile.list Discover source or fields available for Profile queries View available sources in the Profile domain mode, source Read-only
owl.logging.list Discover source or fields available for logging queries List available sources in the logging domain mode, source Read-only
owl.billing.list Discover source or fields available for Billing queries List available fields in the Billing domain mode, source Read-only
owl.log_index.list List indexes available for logging queries List current log indexes None Read-only
owl.log_index.get Query details of a single log index Query details of this log index UUID index_uuid Read-only
owl.field_schema.get Query current field catalog for query field completion List current available field catalog None Read-only
owl.profiling.get_summary Query summary information of a Profiling record View summary information for this profile_id profile_id, timeRange Read-only
owl.profiling.parse Parse detailed content of a Profiling record Parse detailed stack information of this Profiling record profile_id, language, type, profile_start, profile_end Read-only

Errors

Used for error center issue list query, and comment addition, query, and update.

Tool Name Function Example Use Case Key Parameters Permission
owl.errors.list Query error center issue list Query error issue list from the last 24 hours start_time, end_time, page_size, page_index, conditions, assigner, issue_status Read-only
owl.errors.comment.add Add a comment to an error issue Add a troubleshooting comment to this error issue issue_id, comment, attachment_uuids, extend Write
owl.errors.comment.list Query comment list for an error issue View comment records for this error issue issue_id, page_size, page_index Read-only
owl.errors.comment.update Update an existing error comment Update the content of this error comment comment_uuid, comment, attachment_uuids, extend Write

Event

Used for event center list query and event detail retrieval.

Tool Name Function Example Use Case Key Parameters Permission
owl.event.list Query event list Query critical events from the last 1 hour start_time, end_time, status, limit Read-only
owl.event.get Query details of a single event Query details of this event doc_id doc_id Read-only

Incident

Used for incident list, incident comments, operation records, and on-call schedule query.

Tool Name Function Example Use Case Key Parameters Permission
owl.incident.list Query incident list Query all current incident tickets search, page_size, page_index Read-only
owl.incident_comment.list Query incident comment list View comment records for this incident ticket incident_uuid Read-only
owl.incident_comment.add Add a comment to an incident ticket Add a processing progress note to this incident ticket incident_uuid, comment Write
owl.incident_operation.list Query incident operation records View operation history for this incident ticket incident_uuid, page_size, page_index Read-only
owl.incident_schedule.list Query on-call schedule list Query current on-call schedule list search, page_size, page_index Read-only
owl.incident_schedule.get Query on-call schedule details Query detailed configuration of this on-call schedule schedule_uuid Read-only

Infrastructure

Used for infrastructure object list and detail query, covering resource objects such as hosts, containers, processes, etc.

Tool Name Function Example Use Case Key Parameters Permission
owl.infrastructure.list Query infrastructure object list Query all current host objects resource_type, limit, filters Read-only
owl.infrastructure.get Query details of a single infrastructure object Query detailed information of this container object resource_type, identity_value Read-only

LLM

Used for LLM observable application list query.

Tool Name Function Example Use Case Key Parameters Permission
owl.llm.list Query LLM application list List all current LLM applications search, type, page_size, page_index Read-only

Member

Used for workspace member list query and retrieval by name or email keyword.

Tool Name Function Example Use Case Key Parameters Permission
owl.member.list Query workspace member list Search for members whose email contains alice search Read-only

Monitor

Used for monitor list query, detail retrieval, creation or update, and external event reception.

Tool Name Function Example Use Case Key Parameters Permission
owl.monitor.list Query monitor list Query currently enabled monitors search, status_list Read-only
owl.monitor.get Query monitor details Query the full configuration of this monitor rule rule_uuid Read-only
owl.monitor.upsert Create a monitor or update an existing monitor Create a new external event monitor json_script, rule_uuid, status, secret, alert_policy_uuids, tags Write
owl.monitor.receive Send external events to the receiver Send a test event to this monitor event, target, monitor, extra_data Write

Pipeline

Used for Pipeline list query and sample validation.

Tool Name Function Example Use Case Key Parameters Permission
owl.pipeline.list Query Pipeline list and return decoded content List Pipelines whose names contain nginx search, scope, categories Read-only
owl.pipeline.validate Validate Pipeline processing results with sample data Use this log sample to validate if this Pipeline can parse correctly content, testData, dataType Read-only

CLI Usage Paths

Data Query Problems

Applicable to problems like "querying Metrics, Log, RUM, APM, Network, Profile, Billing data".

  1. First execute owl.data.show_dql_namespace to confirm the target namespace.
  2. Call discovery tools by data domain:

    • Metrics: owl.metric.list
    • RUM: owl.rum.list
    • APM: owl.apm.list
    • Network: owl.network.list
    • Profile: owl.profile.list
    • Logging: owl.logging.list
    • Billing: owl.billing.list
    • Log Index: owl.log_index.list
    • Field Catalog: owl.field_schema.get
  3. When DQL syntax confirmation is needed, first call owl.data.search_dql_docs to search documentation.

  4. After writing the full DQL manually, first call owl.data.check_dql for local validation.
  5. Finally, call owl.data.query to execute the formal query.

Profiling Analysis Problems

Applicable to problems like "already have a profile_id, want to view summary or parse detailed stack information".

  1. First locate the target profile_id in the Profiling data domain via owl.data.query.
  2. Call owl.profiling.get_summary to get summary information.
  3. Reuse language, type, profile_start, profile_end from the summary result, then call owl.profiling.parse to parse detailed content.

Incident Troubleshooting Problems

Applicable to problems like "query incident tickets, track processing progress, add comments".

  1. First call owl.incident.list to query incident tickets.
  2. Based on incident_uuid, continue calling:

    • owl.incident_comment.list to view comments
    • owl.incident_operation.list to view operation records
    • When processing progress needs to be added, call owl.incident_comment.add.

Dashboard Management Problems

Applicable to problems like "creating dashboards, replacing dashboard content, viewing existing dashboard configurations".

  1. Call owl.dashboard.create when creating a new dashboard.
  2. Call owl.dashboard.replace when replacing an existing dashboard.
  3. Call owl.dashboard.get when needing to view current configuration.

Monitor Management Problems

Applicable to problems like "viewing monitors, creating monitors, updating monitors, sending test events".

  1. First call owl.monitor.list to browse target monitors.
  2. Call owl.monitor.get when details are needed.
  3. Call owl.monitor.upsert when creating or updating.
  4. Call owl.monitor.receive when needing to send external events to verify the reception pipeline.

Feedback

Is this page helpful? ×