patch: Added query limit to execute_dql

[christian-kreuzberger-dtx]

This helps to further avoid context-overload of the LLM, and to reduce query costs (in case the user uses very broad queries, like fetch all logs).

[MrManny]

So the PR description says

reduce query costs

And the changes say

These limits apply only to the returned payload, not the underlying DQL execution.

I am confused.

And what does the fox say?!

[christian-kreuzberger-dtx]

reduce query costs

vs.

These limits apply only to the returned payload, not the underlying DQL execution.

When the limit is hit, DQL execution should stop (at least that's what I was told), therefore reducing query costs. This at least prevents to accumulate a lot of GB scanned when going over large timespans of logs. If someone uses summarize count(), by: { ...} though, the DQL query will go over all those logs anyway, but only the summary is sent to the MCP server, therefore reducing what's presented to the LLM, therefore reducing context size.

[MrManny]

When the limit is hit, DQL execution should stop (at least that's what I was told), therefore reducing query costs.

That's also how I'd understand the limit. I am just confused because I'd understand

These limits apply only to the returned payload, not the underlying DQL execution.

as "this doesn't stop the DQL to go nuts, we'll fix/trim it in post"