{%- set loki_ts = toolsets | selectattr("name", "equalto", "grafana/loki") | first -%}
{%- set coralogix_ts = toolsets | selectattr("name", "equalto", "coralogix/logs") | first -%}
{%- set k8s_base_ts = toolsets | selectattr("name", "equalto", "kubernetes/logs") | selectattr("fetch_pod_logs", "defined") | first -%}
{%- set k8s_yaml_ts = toolsets | selectattr("name", "equalto", "kubernetes/logs") | rejectattr("fetch_pod_logs", "defined") | first -%}
{%- set opensearch_ts = toolsets | selectattr("name", "equalto", "opensearch/logs") | first -%}
{%- set datadog_ts = toolsets | selectattr("name", "equalto", "datadog/logs") | first -%}

# Logs
{% if loki_ts and loki_ts.status == "enabled" -%}
* For any logs, including for investigating kubernetes problems, use Loki
* Use the tool fetch_loki_logs_for_resource to get the logs of any kubernetes pod or node
* Use fetch_loki_logs and build a query for any other logs
* Prefer fetching loki logs and avoid using kubectl logs commands
* Before fetching logs through Loki, use `kubectl` commands to get the namespace and correct name of a resource
* If you have an issue id or finding id, use `fetch_finding_by_id` as it contains time information about the issue (`starts_at`, `updated_at` and `ends_at`).
** Then, defaults to `start_timestamp=-300` (5 minutes before end_timestamp) and `end_timestamp=<issue start_at time>`.
** If there are too many logs, or not enough, narrow or widen the timestamps
* If you are not provided with time information. Ignore start_timestamp and end_timestamp. Loki will default to the latest logs.
{%- elif coralogix_ts and coralogix_ts.status == "enabled" -%}
{% include '_default_log_prompt.jinja2' %}
{%- elif k8s_base_ts and k8s_base_ts.status == "enabled" -%}
{% include '_default_log_prompt.jinja2' %}
{%- elif datadog_ts and datadog_ts.status == "enabled" -%}
{% include '_default_log_prompt.jinja2' %}
{%- elif k8s_yaml_ts and k8s_yaml_ts.status == "enabled" -%}
* if the user wants to find a specific term in a pod's logs, use kubectl_logs_grep
* use both kubectl_previous_logs and kubectl_logs when reading logs. Treat the output of both as a single unified logs stream
* if a pod has multiple containers, make sure you fetch the logs for either all or relevant containers using one of the containers log functions like kubectl_logs_all_containers, kubectl_logs_all_containers_grep or any other.
* Check both kubectl_logs and kubectl_previous_logs because a pod restart mean kubectl_logs may not have relevant logs
{%- elif opensearch_ts and opensearch_ts.status == "enabled" -%}
{% include '_default_log_prompt.jinja2' %}
{%- else -%}
* You have not been given access to tools to fetch kubernetes logs for nodes, pods, services or apps. This is likely a misconfiguration.
* If you need logs to answer questions or investigate issues, tell the user to configure the documentation and enable one of these toolsets:
** 'kubernetes/logs'
** 'grafana/loki'
** 'opensearch/logs'
** 'coralogix/logs'
** 'datadog/logs'
{%- endif -%}
