Logstreem
Events

Events

The unit of data: one JSON object with a timestamp. Logs, metrics and spans are all events here.

An event is one JSON object. Logstreem does not distinguish logs from metrics from spans at the storage layer — they differ only in which fields they carry. That is why one query language reaches all of them.

A typical inbound event
{
  "_time": "2026-09-06T09:41:02.114Z",
  "level": "error",
  "service": "checkout",
  "status": 503,
  "latency": 3814,
  "method": "POST",
  "route": "/v1/checkout",
  "region": "us-east-1",
  "message": "pool exhausted: 40/40 connections",
  "trace": {
    "id": "7b2d93c3ab4c2f10",
    "span_id": "a41c9e02"
  }
}

The _time field

Every event has a _time. Send one and it is used; omit it and ingest stamps arrival time. It accepts RFC 3339, unix seconds, unix milliseconds or unix nanoseconds — the format is detected by magnitude.

Late events are accepted, not reordered

An event with a _time from an hour ago lands in the right time bucket for queries. But a monitor that already evaluated that window will not re-fire. Backfills are for querying, not for alerting.

Nested objects

Nested JSON is stored as-is and flattened for query with dot paths. trace.id above is addressed as ['trace.id'] in LSQL. Arrays are stored whole; index into them with array[0].

Reaching a nested field
read top to bottom
1['api-gateway-prod']
2| where ['trace.id'] == "7b2d93c3ab4c2f10"
3| project _time, service, route, latency
4| order by _time asc

Reserved fields

FieldMeaning
_timeEvent timestamp. Always present
_sysTimeWhen ingest received it. Set by us, not overridable
_datasetDataset name, injected at query time for cross-dataset results
PreviousDatasetsNextSchema on read