Quickstart

There is no schema to define and no dataset to create in advance. Sending to a dataset name that does not exist creates it.

1. 1

   Create a token

   Dashboard → Tokens → New token, scoped to ingest and query. The secret is shown once.

   Shell

   export LOGSTREEM_TOKEN="lstrm_test_sandbox"

2. 2

   Send an event

   Post an array of JSON objects. Fields are discovered as they arrive.

   cURL

   curl -X POST https://api.logstreem.com/v1/ingest/api-gateway-prod \
     -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
     -H "Content-Type: application/json" \
     -d '[
       {
         "level": "error",
         "service": "checkout",
         "status": 503,
         "latency": 3814,
         "route": "/v1/checkout",
         "region": "us-east-1",
         "message": "pool exhausted: 40/40 connections"
       }
     ]'

3. 3

   Query it back

   LSQL starts with a dataset and pipes from there. This one groups the last hour's errors by service.

   cURL

   curl -X POST https://api.logstreem.com/v1/query \
     -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
     -H "Content-Type: application/json" \
     -d @- <<'JSON'
   {
     "apl": "['api-gateway-prod']\n| where status >= 500\n| summarize errors = count(), p95 = percentile(latency, 95) by service\n| order by errors desc"
   }
   JSON

What comes back

{
  "object": "query_result",
  "columns": ["service", "errors", "p95"],
  "rows": [
    { "service": "checkout", "errors": 41, "p95": 3106 },
    { "service": "payments", "errors": 27, "p95": 2884 }
  ],
  "status": {
    "elapsed_ms": 112,
    "rows_examined": 14200000000,
    "rows_matched": 68,
    "blocks_scanned": 412
  }
}

Try it now

The panel below runs against the documentation sandbox. Edit the query and the answer changes — it is a real evaluator, not a canned response.

Next