Logs

Changed on
post/logs/global/facets

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/logs/global/facets
  • Auth: HTTP bearer

Request body

attrsstring[]

Attribute predicates (ADR-047 §5): <key><op><value> with op one of =, !=, ^= (prefix), >, <, or <key>? for "exists". Requires the line index; when combined with text, the text filter is applied in memory over the lines the index already matched (the index holds no message bytes, so it cannot answer text on its own).

container_idsstring[]

Docker container IDs.

cursorstring nullable

Opaque cursor from the previous page's next_cursor.

deploy_idinteger nullable
end_timestring required
envsstring[]
external_servicesstring[]

Database/service IDs or names, not container service labels.

levelsLogLevel[]
node_idsinteger[]
page_sizeinteger nullable

Defaults to 200, server-capped at 1000.

projectsstring[]

Match project ID, slug or name. Empty selects all authorized projects.

scopesstring[]

Explicit resource identities, e.g. application:12 or service:34.

servicesstring[]

Container service labels (the service column), e.g. web, worker.

source'collected' | 'application' | 'service'

Which family of log sources a query covers.

start_timestring required
textstring nullable

Case-insensitive substring match over the message.

fieldsFacetField[]

Fields to return distinct values for. Empty returns the default set.

Response

external_service_namesobject required

Display names for the returned external_service_id values; see project_names.

facetsobject required

Keyed by field name (env, service, level, node_id, …). Values are ordered by count, descending.

partialboolean required

true when a field's value list was capped or timed out, so it is a prefix rather than the complete set. Reported rather than glossed: the point of a facet is that a user can trust it to surface values they have never seen on screen.

project_namesobject required

Display names for the returned project_id values, keyed by value. Resolved here, under the log access that produced the facets, so a caller who may read these logs can tell the projects apart without also needing permission to read projects — the same names search lines carry as owner. A returned value missing from this map names a project this instance no longer has.

Changes