fix(mcp): enrich host log evidence params

apps/api/src/services/pre_decision_investigator.py

@@ -619,17 +619,30 @@ def _build_tool_params(incident: "Incident") -> dict[str, Any]:
         or target
         or pod_name
     )
+    container_name = (
+        labels.get("container_name")
+        or labels.get("container")
+        or labels.get("name")
+        or service_name
+    )
+    log_severity = labels.get("log_severity") or labels.get("severity", "")
+    if not log_severity and any(k in alertname.lower() for k in ("error", "fatal", "critical")):
+        log_severity = "ERROR,FATAL,CRITICAL"
+
     return {
         "namespace": namespace,
         "pod_name": pod_name,
         "deployment": labels.get("deployment", ""),
         "host": host,
         "container": labels.get("container", labels.get("name", "")),
+        "container_name": container_name,
+        "filter_name": labels.get("filter_name") or container_name,
         "target": target,
+        "service": labels.get("unit") or labels.get("service") or service_name,
         "service_name": service_name,
         "alertname": alertname,
         "search_text": alertname,
-        "severity": labels.get("severity", ""),
+        "severity": log_severity,
         "time_window_minutes": 30,
         "limit": 100,
         # P0.4 fix 2026-04-24 ogt + Claude Sonnet 4.6: Prometheus tool 需要 query 欄位

apps/api/src/services/signoz_client.py

@@ -433,8 +433,8 @@ class SignOzClient:
         """
         從 SignOz/ClickHouse 查詢日誌 (Phase 13.1 #77)
 
-        SignOz 日誌儲存在 signoz_logs.distributed_logs 表
-        Schema: timestamp, severity_text, body, resources, attributes
+        SignOz v0.8+ 日誌儲存在 signoz_logs.distributed_logs_v2 表
+        Schema: timestamp, severity_text, body, resources_string, attributes_string
 
         Args:
             service_name: 服務名稱 (過濾 resources.service.name)
@@ -458,7 +458,8 @@ class SignOzClient:
 
         if service_name:
             # SignOz 儲存 service.name 在 resources 欄位
-            conditions.append(f"resources['service.name'] = '{service_name}'")
+            safe_service = service_name.replace("'", "''")
+            conditions.append(f"resources_string['service.name'] = '{safe_service}'")
 
         if severity:
             # 支援多個級別 (如 'ERROR,WARN')
@@ -478,11 +479,11 @@ class SignOzClient:
             timestamp,
             severity_text,
             body,
-            resources,
-            attributes,
+            resources_string AS resources,
+            attributes_string AS attributes,
             trace_id,
             span_id
-        FROM signoz_logs.distributed_logs
+        FROM signoz_logs.distributed_logs_v2
         WHERE {where_clause}
         ORDER BY timestamp DESC
         LIMIT {limit}
@@ -532,11 +533,11 @@ class SignOzClient:
             severity_text,
             count() as count,
             any(body) as sample_message
-        FROM signoz_logs.distributed_logs
+        FROM signoz_logs.distributed_logs_v2
         WHERE
             timestamp >= {start_ns}
             AND timestamp <= {end_ns}
-            AND resources['service.name'] = '{service_name}'
+            AND resources_string['service.name'] = '{service_name.replace("'", "''")}'
             AND severity_text IN ('ERROR', 'FATAL', 'CRITICAL')
         GROUP BY severity_text
         ORDER BY count DESC