Logstreem docs
Logstreem docs
One endpoint for every log, metric, trace and event. Schema-less ingest, LSQL over petabytes, live tail, monitors and a REST API.
Logstreem takes structured events over one HTTPS endpoint, discovers their fields at ingest, and lets you query all of them with LSQL — no schema, no indexes, no mapping conflicts.
This documentation runs against a sandbox
Start here
Quickstart
Send an event and query it back in three commands.
Send data
HTTP, OpenTelemetry, Vector, Kubernetes and more.
LSQL
The piped query language, top to bottom.
API reference
Every endpoint, parameter and response.
Monitors
Turn any saved query into an alert.
CLI
Ingest, query and tail from your terminal.
The shape of it
Three verbs cover most of what you will do. Send events to a dataset, query that dataset with LSQL, and attach a monitor to the query when you want to be told about it instead of looking.
curl -X POST https://api.logstreem.com/v1/ingest/api-gateway-prod \
-H "Authorization: Bearer $LOGSTREEM_TOKEN" \
-H "Content-Type: application/json" \
-d '[{ "level": "error", "service": "checkout", "latency": 3814 }]'Vocabulary
| Term | What it means |
|---|---|
| Event | One JSON object with a timestamp. A log line, a metric sample, a span — all the same thing here |
| Dataset | The container events land in. Addressed as ['name'] in LSQL and /v1/ingest/:dataset over HTTP |
| Field | A key discovered at ingest and typed at query time. 4,096 per dataset |
| Virtual field | A column computed at query time with extend, so old data gains new columns |
| LSQL | The piped query language. Read it top to bottom, exactly how you debug |
| Live tail | Streaming search over the write path, under 800 ms behind |
| Monitor | A saved query with a threshold or anomaly condition, routed to a notifier |
Base URL
https://api.logstreem.com/v1All requests are HTTPS. Bodies are JSON, except bulk ingest which also accepts NDJSON. Timestamps are RFC 3339 in UTC. Every response carries an X-Request-Id — log it.