Run a log query

Run a log query with no model involved, given either the queryId of an earlier logs.ask answer or logs.executeQuery run, or a spec written in the log query spec (its JSON Schema is this operation's spec input; sazabi logs query schema prints it). Runs over window (by default the same absolute times a queryId read, or the last hour for a spec; a relative window ends now, which asks the same question again over the latest period), with an optional limit, or narrowed to the log lines of one group of a table. Returns the same envelope as logs.ask without an answer: results, what was measured (explanation), the part of the window the numbers cover (meta), and a new queryId naming this run (its query and the times it read). A run by queryId names that id as parentId. rows results page: when more lines matched than limit holds the envelope carries a nextCursor, and passing it as cursor with the same query reads the next limit lines over the same times; a table, series, value or kinds result returns at most limit groups and never pages. An unknown queryId is not found; a spec the service cannot run is refused with what to change; asking the question again yields a new id.

POST https://api.sazabi.com/v1/logs/queries/execute

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

projectId?string

Project to run the query in. Auto-filled from CLI and SDK context when omitted.

Formatuuid

queryId?string

queryId of an earlier logs.ask answer or logs.executeQuery run, to run that query again. Give queryId or spec, not both.

Formatuuid

spec?

A log query to run, written in the log query spec: which lines (predicate), grouped by what (dimensions), measured how (measure), shaped as what (output). The spec carries no time range; pass window. Give queryId or spec, not both.

window?|

Time window to run the query over. With queryId it defaults to the same absolute times that query read, however long ago, so the results match the answer; with spec, to the last hour. A relative window (such as the last 6 hours) ends now, which asks the same question again over the latest period.

limit?integer

Maximum rows, groups, points or kinds in results (1-5,000). It only pages results: the answer, and each result's matched and total, are computed over every matching line whatever the limit. Rows are the newest (or earliest) matching lines, up to this many; tables, series and top messages are cut to this many of the groups or points the question asks for (its top 20, or the top N it names); a search's results show at most 50 kinds of log lines. truncated says when more matched than results shows.

Range1 <= value <= 5000

group?array<>

For a query whose results are a table: return the log lines of one group instead of the table, as one value per column before the measure (a group's key).

Items1 <= items <= 3

cursor?string

The nextCursor of an earlier page of rows results, to read the next page of the same query over the same window. Opaque: it names the query, the times it pages and the last line of the page before, which the next page continues past in the query's own order (so a line that lands late inside the window is neither repeated nor skipped); a cursor given with another queryId, spec or window is refused. limit is the page size. Only rows results page; a table, series, value or kinds result never carries a nextCursor. On a page after the first, matched counts the lines from the page's position to the end of the window.

Length1 <= length <= 1024

Response Body

`application/json`

curl -X POST "https://example.com/logs/queries/execute" \  -H "Content-Type: application/json" \  -d '{}'

{  "queryId": "10210520-b895-40ca-bce5-474f9643bf53",  "parentId": "70850378-7d3c-4f45-91b7-942d4dfbbd43",  "status": "ok",  "answer": "string",  "explanation": "string",  "interpretedAs": "string",  "results": {    "kind": "search",    "kinds": [      {        "message": "string",        "severity": "string",        "services": [          {            "service": "string",            "count": 0          }        ],        "count": 0,        "previousCount": 0,        "firstSeen": "string",        "firstSeenInWindow": true,        "lastSeen": "string",        "examples": [          {            "id": "string",            "time": "string",            "service": "string",            "severity": "string",            "body": "string",            "attributes": {              "property1": "string",              "property2": "string"            },            "traceId": "string",            "spanId": "string"          }        ]      }    ],    "matched": 0,    "truncated": true,    "previousWindow": {      "from": "2019-08-24T14:15:22Z",      "to": "2019-08-24T14:15:22Z"    }  },  "window": {    "from": "2019-08-24T14:15:22Z",    "to": "2019-08-24T14:15:22Z"  },  "periods": [    {      "name": "string",      "window": {        "from": "2019-08-24T14:15:22Z",        "to": "2019-08-24T14:15:22Z"      },      "results": {        "kind": "search",        "kinds": [          {            "message": "string",            "severity": "string",            "services": [              {                "service": "string",                "count": 0              }            ],            "count": 0,            "previousCount": 0,            "firstSeen": "string",            "firstSeenInWindow": true,            "lastSeen": "string",            "examples": [              {                "id": "string",                "time": "string",                "service": "string",                "severity": "string",                "body": "string",                "attributes": {                  "property1": "string",                  "property2": "string"                },                "traceId": "string",                "spanId": "string"              }            ]          }        ],        "matched": 0,        "truncated": true,        "previousWindow": {          "from": "2019-08-24T14:15:22Z",          "to": "2019-08-24T14:15:22Z"        }      }    }  ],  "meta": {    "coverage": {      "from": "2019-08-24T14:15:22Z",      "to": "2019-08-24T14:15:22Z",      "status": "complete",      "reason": "stored_range"    }  },  "rejection": {    "code": "bucket_too_fine",    "message": "string"  },  "writeDeclined": true,  "attempts": [    {      "n": 0,      "action": "string"    }  ],  "timings": {    "planMs": 0,    "executeMs": 0,    "answerMs": 0,    "totalMs": 0  },  "nextCursor": "string"}

Request Body

Response Body

200application/json

`application/json`