Skip to main content
GET
Search log records
Requires the IAM action telemetry:ReadLogs. See TELEMETRY permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Query Parameters

from
string<date-time>
required

Lower bound on timestamp (inclusive)

Example:

"2026-01-15T00:00:00Z"

to
string<date-time>
required

Upper bound on timestamp (exclusive); must be after from and within 31d

Example:

"2026-01-16T00:00:00Z"

log_group
string

Filter by log-group UUID, CRN or exact name in the authenticated account. CRNs must match the serving region and account handle; invalid references never fall back to names.

Example:

"/app/prod/api"

log_stream
string

Filter by stream name within the group

Example:

"api-host-07"

min_severity
enum<string>

Filter to records with severity >= this band

Available options:
TRACE,
DEBUG,
INFO,
WARN,
ERROR,
FATAL
Example:

"WARN"

region
string

Filter by emitter region

Example:

"sa-saopaulo-1"

q
string

Case-insensitive substring on the log body

Example:

"status=200"

trace_id
string

Filter to records carrying this W3C trace id

Example:

"4bf92f3577b34da6a3ce929d0e0e4736"

limit
integer
default:50

Maximum number of items to return. A value above the maximum is clamped to it rather than rejected, so a page shorter than the one you asked for is normal — page until meta.has_more is false, not until a page looks short.

Required range: 1 <= x <= 100
marker
string

Opaque pagination cursor. Echo back the meta.marker value from the previous page to fetch the next one; do not construct or parse it. The token's internal form varies by endpoint (a resource ID, a timestamp, …) and is not guaranteed stable across releases.

Response

Page of log records

logs
object[]
required
meta
object
required