Query Logs
const url = 'https://example.com/observability/v1/workspaces/example/engines/example/logs:query';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"workspace":"example","engine":"example","query":"example","start":"2026-04-15T12:00:00Z","end":"2026-04-15T12:00:00Z","limit":1,"filter":"example","order_by":"example","organisation":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/observability/v1/workspaces/example/engines/example/logs:query \ --header 'Content-Type: application/json' \ --data '{ "workspace": "example", "engine": "example", "query": "example", "start": "2026-04-15T12:00:00Z", "end": "2026-04-15T12:00:00Z", "limit": 1, "filter": "example", "order_by": "example", "organisation": "example" }'Runs a bounded log query scoped to the workspace and returns one page of lines.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”The workspace whose telemetry is queried, or ’-’ for an organisation-wide query across
every workspace under organisation the caller may read (AIP-159; read-only).
The provider: qibdo, aws, gcp, or azure.
Request Body required
Section titled “Request Body required ”QueryLogsRequest
Request for QueryLogs.
object
The workspace whose telemetry is queried, or ’-’ for an organisation-wide query across
every workspace under organisation the caller may read (AIP-159; read-only).
The provider: qibdo, aws, gcp, or azure.
The native log query expression (LogQL for the qibdo engine).
Start of the query window (inclusive).
End of the query window (exclusive).
Maximum lines to return.
AIP-160 filter expression.
AIP-132 order_by expression (e.g. ‘timestamp desc’).
The organisation to federate across when workspace is ’-’. Required (and authorized at
organisation scope) for an organisation-wide query; ignored for a single-workspace query.
Example generated
{ "workspace": "example", "engine": "example", "query": "example", "start": "2026-04-15T12:00:00Z", "end": "2026-04-15T12:00:00Z", "limit": 1, "filter": "example", "order_by": "example", "organisation": "example"}Responses
Section titled “ Responses ”OK
QueryLogsResponse
Response for QueryLogs.
object
The matching log lines.
LogEntry
A single log line returned by a query or live tail.
object
When the line was emitted.
The raw log line.
The stream labels (the unique label set this line belongs to).
object
The continuation cursor, empty when this is the last page.
The provider that served the query.
Example
{ "engine": "ENGINE_UNSPECIFIED"}default
Section titled “default ”Default error response
The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.
object
The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
A list of messages that carry the error details. There is a common set of message types for APIs to use.
Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
object
The type of the serialized message.
Example generated
{ "code": 1, "message": "example", "details": [ { "@type": "example" } ]}