Logstreem
Views

Views

A saved filter that behaves like its own dataset.

A view is a named where over a dataset. Query it exactly like a dataset — ['checkout-errors'] — and the filter is applied for you. Nothing is copied; it resolves at read time.

cURL
curl -X POST https://api.logstreem.com/v1/datasets/api-gateway-prod/views \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "checkout-errors",
    "filter": "service == \"checkout\" and status >= 500"
  }'
Querying the view
read top to bottom
1['checkout-errors']
2| summarize errors = count() by bin(_time, 5m), route
3| order by _time asc

Views are an access-control tool

A token can be scoped to a view instead of a dataset. That is how you give a contractor, a vendor or a customer-facing dashboard access to one slice of a dataset without exposing the rest — see RBAC.

A view is not a security boundary on its own

It only restricts anything if the token is scoped to the view. A token with dataset access can always query around it.
PreviousSaved queriesNextVirtual fields in the console