VictoriaLogs¶

Connect HolmesGPT to VictoriaLogs for log analysis. Provides search, stream discovery, and field-value enumeration over your log database using LogsQL.

When to Use This¶

✅ You aggregate logs in VictoriaLogs
✅ You want HolmesGPT to query historical logs by stream label, field, or text
✅ You need to inspect log distributions over time (hits/buckets)

Prerequisites¶

A reachable VictoriaLogs HTTP endpoint (default port: 9428)

Available Log Sources

Multiple logging toolsets can be enabled simultaneously. HolmesGPT will use the most appropriate source for each investigation.

Kubernetes logs - Direct pod log access (enabled by default)
Loki - Centralized logs via Loki
Elasticsearch / OpenSearch - Logs from Elasticsearch/OpenSearch
Coralogix - Logs via Coralogix platform
DataDog - Logs from DataDog

Configuration¶

Holmes CLI Holmes Helm Chart Robusta Helm Chart

Add the following to ~/.holmes/config.yaml. Create the file if it doesn't exist:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: http://victorialogs.monitoring.svc:9428

When using the standalone Holmes Helm Chart, update your values.yaml:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: http://victorialogs.monitoring.svc:9428

Apply the configuration:

helm upgrade holmes holmes/holmes --values=values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), update your generated_values.yaml:

holmes:
  toolsets:
    victorialogs:
      enabled: true
      config:
        api_url: http://victorialogs.monitoring.svc:9428

Apply the configuration:

helm upgrade robusta robusta/robusta --values=generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

Authentication¶

VictoriaLogs supports basic authentication and bearer tokens.

Basic auth:

Holmes CLI Holmes Helm Chart Robusta Helm Chart

Add the following to ~/.holmes/config.yaml. Create the file if it doesn't exist:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: https://victorialogs.example.com
      username: holmes
      password: "{{ env.VICTORIALOGS_PASSWORD }}"

When using the standalone Holmes Helm Chart, update your values.yaml:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: https://victorialogs.example.com
      username: holmes
      password: "{{ env.VICTORIALOGS_PASSWORD }}"

Apply the configuration:

helm upgrade holmes holmes/holmes --values=values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), update your generated_values.yaml:

holmes:
  toolsets:
    victorialogs:
      enabled: true
      config:
        api_url: https://victorialogs.example.com
        username: holmes
        password: "{{ env.VICTORIALOGS_PASSWORD }}"

Apply the configuration:

helm upgrade robusta robusta/robusta --values=generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

Bearer token:

Holmes CLI Holmes Helm Chart Robusta Helm Chart

Add the following to ~/.holmes/config.yaml. Create the file if it doesn't exist:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: https://victorialogs.example.com
      bearer_token: "{{ env.VICTORIALOGS_TOKEN }}"

When using the standalone Holmes Helm Chart, update your values.yaml:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: https://victorialogs.example.com
      bearer_token: "{{ env.VICTORIALOGS_TOKEN }}"

Apply the configuration:

helm upgrade holmes holmes/holmes --values=values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), update your generated_values.yaml:

holmes:
  toolsets:
    victorialogs:
      enabled: true
      config:
        api_url: https://victorialogs.example.com
        bearer_token: "{{ env.VICTORIALOGS_TOKEN }}"

Apply the configuration:

helm upgrade robusta robusta/robusta --values=generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

Multi-tenancy¶

VictoriaLogs uses AccountID and ProjectID headers for tenant routing. Set them via headers:

Holmes CLI Holmes Helm Chart Robusta Helm Chart

Add the following to ~/.holmes/config.yaml. Create the file if it doesn't exist:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: https://victorialogs.example.com
      headers:
        AccountID: "0"
        ProjectID: "0"

When using the standalone Holmes Helm Chart, update your values.yaml:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: https://victorialogs.example.com
      headers:
        AccountID: "0"
        ProjectID: "0"

Apply the configuration:

helm upgrade holmes holmes/holmes --values=values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), update your generated_values.yaml:

holmes:
  toolsets:
    victorialogs:
      enabled: true
      config:
        api_url: https://victorialogs.example.com
        headers:
          AccountID: "0"
          ProjectID: "0"

Apply the configuration:

helm upgrade robusta robusta/robusta --values=generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

External URL for clickable links¶

If HolmesGPT calls an internal API URL but you want results to link to a public dashboard:

Holmes CLI Holmes Helm Chart Robusta Helm Chart

Add the following to ~/.holmes/config.yaml. Create the file if it doesn't exist:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: http://victorialogs.internal:9428
      external_url: https://logs.example.com

When using the standalone Holmes Helm Chart, update your values.yaml:

toolsets:
  victorialogs:
    enabled: true
    config:
      api_url: http://victorialogs.internal:9428
      external_url: https://logs.example.com

Apply the configuration:

helm upgrade holmes holmes/holmes --values=values.yaml

When using the Robusta Helm Chart (which includes HolmesGPT), update your generated_values.yaml:

holmes:
  toolsets:
    victorialogs:
      enabled: true
      config:
        api_url: http://victorialogs.internal:9428
        external_url: https://logs.example.com

Apply the configuration:

helm upgrade robusta robusta/robusta --values=generated_values.yaml --set clusterName=<YOUR_CLUSTER_NAME>

Common Use Cases¶

Show error logs for the checkout service in the last 30 minutes

Which services produced the most errors in the last hour?

List the streams in namespace "payments" between 10:00 and 11:00 UTC