---
title: "Search logs (LogQL, or the filter params)"
method: POST
path: "/preview/logs/queries"
tags: ["logs"]
---

# Search logs (LogQL, or the filter params)

`POST /preview/logs/queries`

## Request

- Base URL: `https://autoresearch.sfcompute.com`
- URL: `https://autoresearch.sfcompute.com/preview/logs/queries`
- Auth: HTTP bearer

Your logs, one call instead of a run_command tail loop: every detached command's AND every job run's stdout/stderr ships here as produced, labeled by mission and run (block buffering and stopped nodes stop mattering - logs outlive nodes and disks). Filter by mission / run (a job-/cmd-/ses- id) / node / text substring for the common case, or pass full LogQL. Returns time-ordered lines, newest kept when the limit cuts (truncated:true) - narrow the range or filter rather than paging.

## Query parameters

- `workspace` string

## Request body

- object
  - `end` string, nullable: Range end, RFC3339 (default: now).
  - `limit` integer, nullable: Max lines returned, newest kept (default 100, cap 1000).
  - `mission` string, nullable: Filter: mission name (composes {mission="..."}).
  - `node` string, nullable: Filter: node name (composes {node="..."}).
  - `query` string, nullable: Full LogQL (optional - the filter params below compose the query for the common case). `$mission`/`$run` substitute the params.
  - `run` string, nullable: Filter: one run - a job-/cmd-/ses- scope id (composes {run="..."}).
  - `start` string, nullable: Range start, RFC3339 (default: one hour before `end`).
  - `text` string, nullable: Filter: plain-text substring the line must contain (|= "...").

## Response `200`

The capability's JSON result.

- Result: The capability's result: the same object the MCP tool returns as structuredContent. Resources carry an `object` type discriminator and an immutable id; money is integer micro-dollars in `*_usd_micros` fields.
  - `object` string: The resource type, when the result is one resource.

## Other responses

- `400`: Malformed request: bad JSON, a parameter that does not parse, or a value outside its range. Code `invalid`.
- `401`: No bearer token, or one this API cannot verify. Code `unauthenticated`.
- `403`: Authenticated, but the token's scopes or the account's role do not reach this operation. The message names the scope word to request. Code `forbidden`.
- `404`: No such route. Code `not_found`; the body names the OpenAPI document.
- `422`: A well-formed request the platform declined: no such node, a cap reached, a state that forbids the move. The message says which, and what to do instead. Code `refused`.
- `429`: Over this door's per-customer budget. Wait `Retry-After` seconds. Code `rate_limited`.
- `500`: Our fault. Retry; if it persists, quote the request-id. Code `internal`.

---

[API](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api.md) · [All operations](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/givemeanode/apis/autoresearch-customer-api/revisions/f88dcb70ac6c?raw)