Sandbox
Sandbox
What the documentation sandbox does, what it does not, and how to tell its responses apart.
Simulated, not live
The Try it panels in this documentation call endpoints hosted on this site. They store nothing, make no outbound requests, and are not connected to a Logstreem account.
Telling sandbox responses apart
- Every response body has a top-level
"sandbox": true. - Every response carries
X-Logstreem-Sandbox: true. - Sandbox responses are also
X-Robots-Tag: noindex, nofollow. - Ids are derived from your input, so the same request always returns the same ids.
The query endpoint is real
One exception is worth knowing about. POST /v1/query in the sandbox actually parses and evaluates your LSQL against a fixed set of 240 events spread over the last hour, across six services and four regions. Change the filter and the rows genuinely change; write invalid syntax and you get the real parse error, with a line number.
| Supported in the sandbox | Not supported |
|---|---|
where with == != > >= < <= =~ | Parentheses in where |
in (…), contains, has, startswith, endswith | join, make-series, render |
extend, project, distinct, count | let bindings |
summarize … by with count dcount sum avg min max percentile | Sub-queries |
order by / sort by, take / limit | Time-range filters on _time |
The sandbox token
Any well-formed token works: it must match lstrm_test_… or lstrm_live_…. The panels default to lstrm_test_sandbox. Send no header, or a malformed one, and you get the real 401 — which is the point.
What is not simulated
| Behaviour | Sandbox |
|---|---|
| Persistence | None — ingest accepts and discards |
| Live tail | The docs show a recorded stream, not a socket |
| Monitors and notifiers | Fixtures; nothing is ever evaluated or sent |
| Rate limiting | Headers are returned, no limit is enforced |
| Retention and billing | Not modelled |