Query

Execute query with NDJSON streaming

Same input as POST /query, returns NDJSON stream. For large result sets, exports, piping.

This is different from job SSE (GET /query/jobs/{id}/stream):

/query/stream — NDJSON export of results. One event per line. For curl | jq, data pipelines.
/query/jobs/{id}/stream — SSE progress tracking. For Web UI real-time updates.
Response: Transfer-Encoding: chunked, one JSON object per line.
Last line is always {"__meta": {...}} — stream summary.
No default limit (streaming is for export). Client disconnect = cancellation.
wait parameter is ignored — streaming always blocks until complete.

post/query/stream

Request body

qstring required

SPL2 query string

fromstring

Start time: relative (-1h, -7d) or ISO 8601. Default: -15m

tostring

End time: relative (now, -5m) or ISO 8601. Default: now

limitinteger

Max events to return

offsetinteger

Offset for pagination (tabular results only)

format'json' | 'csv' | 'raw'

waitnumber nullable

Controls sync/async behavior:

null (default) — Sync. Block until query completes or server timeout (30s). Returns 200 with results or 408 on timeout.
0 — Async. Return 202 immediately with a job handle. Client polls or subscribes to SSE for progress.
N (seconds) — Hybrid. Wait up to N seconds. If query completes in time → 200 with results. If not → 202 with job handle and current progress. Best for UI: short queries feel instant, long queries degrade gracefully.

{
  "q": "source=nginx status>=500 | stats count by uri",
  "from": "-1h",
  "wait": 5
}

NDJSON event stream