Logstreem
Run a query
POST

Run a query

Execute LSQL and get columns and rows back.

Send LSQL in the apl field. The dataset comes from the query itself, so this endpoint takes no dataset parameter.

This one is really live

The Try-it panel below runs a genuine LSQL evaluator over 240 sandbox events. Change the filter and the numbers change; break the syntax and you get the real error with a line number.
POST/v1/query

Body parameters

aplstringrequired

The LSQL query. Newlines are significant — see LSQL.

startTimedatetime

Overrides the query's own time filter. RFC 3339.

endTimedatetime

Overrides the query's own time filter. RFC 3339.

formatenumdefault tabular

Response shape.

tabularlegacy

cost_limitinteger

Abort past this many scanned rows. Defaults to the org limit.

curl -X POST https://api.logstreem.com/v1/query \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"apl":"['api-gateway-prod']\n| where status >= 500\n| summarize count() by service"}'

Responses

200OK
{
  "object": "query_result",
  "columns": ["service", "count_"],
  "rows": [
    { "service": "checkout", "count_": 41 },
    { "service": "payments", "count_": 27 }
  ],
  "status": {
    "elapsed_ms": 112,
    "rows_examined": 14200000000,
    "rows_matched": 68,
    "blocks_scanned": 412
  }
}
400Bad query
{
  "error": {
    "type": "query_error",
    "code": "query_syntax_error",
    "message": "Line 2: Could not read the condition 'status >>= 500'.",
    "param": "apl",
    "doc_url": "https://logstreem.com/docs/errors#query_syntax_error",
    "request_id": "req_44b0c9e1287f4a3d8e12"
  }
}
401Unauthorized
{
  "error": {
    "type": "authentication_error",
    "code": "missing_token",
    "message": "No API token provided.",
    "doc_url": "https://logstreem.com/docs/errors#missing_token",
    "request_id": "req_9f3c2a7b41de08c5b2e6"
  }
}
Try itsandbox
PreviousIngest OTLPNextStream results