Saved queries

Name a query once and reuse it in dashboards, monitors and the CLI.

A saved query is LSQL with a name and an owner. It is the unit you promote from "I typed this during an incident" to "this is how we check that".

curl -X POST https://api.logstreem.com/v1/saved-queries \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Checkout error rate",
    "apl": "['\''api-gateway-prod'\'']\n| where service == \"checkout\"\n| summarize requests = count(), errors = countif(status >= 500) by bin_auto(_time)",
    "shared": true
  }'

Where they show up

In ⌘K, by name.
As a dashboard element — pick the saved query instead of pasting LSQL.
As a monitor's query, so the alert and the chart can never drift apart.
In the CLI: logstreem query --saved 'Checkout error rate'.

Save from the incident, not after it

The query you wrote at 3am is the one worth keeping. Saving it takes ⌘S and turns a one-off into the thing that catches the same problem next time.

PreviousLive tail NextViews