logs

Scan a service's logs for volume anomalies

Runs anomaly detection on demand over one service's log volume for the given window. Learns per severity baselines from up to 6 weeks of history and returns per bucket expected bands plus any spike, drop, or silence issues. Synchronous and read only.

post/api/projects/{project_id}/logs/anomalies/scan/

Request

  • Base URL: https://us.posthog.com
  • URL: https://us.posthog.com/api/projects/{project_id}/logs/anomalies/scan/
  • Auth: HTTP bearer

Path parameters

project_idstring required

Project ID of the project you're trying to access. To find the ID of the project, make a call to /api/projects/.

Request body

serviceNamestring required

Service to scan (the log record's service_name). Required: the scan aggregates weeks of baseline history from raw logs, so it is scoped to one service per call.

Response

Scan results: per severity evidence series and any issues that opened.

service_namestring required

Service that was scanned.

eval_startstring date-time required

Actual start of the evaluated window after any clipping.

eval_endstring date-time required

Actual end of the evaluated window after clamping to now.

lookback_daysnumber double required

Days of baseline history the scan used.

eval_clippedboolean required

True when the evaluation window was clipped to fit the read budget. The response covers only the clipped window.

degradedboolean required

True when the scan could not afford the full lookback and fell back to a cheaper configuration.

binding_constraintsBindingConstraintsEnum[] required

Everything that limited the baseline, empty for an unconstrained scan. team_retention: the project's log retention is shorter than the full lookback. byte_budget: the scan degraded to stay inside its ClickHouse read budget.

Changes

No recorded changes to this operation across all 1 revision of this API.