Count Observability logs by field

Count logs matching a Logs explorer query, grouped by service, index, severity or an attribute key (@http.status_code). Answers questions like “errors per service in the last 6h” (filter[query]=severity:error, filter[from]=now-6h, group_by=service). Values are ordered by count, largest first; meta.total counts every matching log, and each value’s logs_query drills into its rows with GET /v1/observability/logs (null for a blank value, which the query syntax cannot select, or when the drill-down would exceed the query limits: 512 characters or 20 clauses). A log can carry an attribute key more than once (log, resource and scope attributes), so attribute counts can add up to more than meta.total; when logs match but none have the attribute, data is empty and meta.warnings has code attribute_missing. Requires a personal or Global API key (Team API Keys are group-scoped and get 403 unsupported_api_key) or an OAuth token with the obs.logs:read (or all) scope, and the Observability logs read permission. A Global API key uses its service user’s Observability role, which starts as the team’s default Observability role. Limited to 60 requests per minute per token; on this endpoint the X-RateLimit-* headers report that per-minute budget, not the default API limit. Every 429 returns the errors envelope with code rate_limited and a Retry-After header.

GET /v1/observability/logs/counts

Count Observability logs by field

cURL

curl --request GET \
  --url https://api.rootly.com/v1/observability/logs/counts \
  --header 'Authorization: Bearer <token>'

200

{
  "data": [
    {
      "id": "<string>",
      "type": "observability_log_counts",
      "attributes": {
        "value": "<string>",
        "count": 123,
        "logs_query": "<string>"
      }
    }
  ],
  "meta": {
    "query": "<string>",
    "group_by": "<string>",
    "window": {
      "from": "2023-11-07T05:31:56Z",
      "to": "2023-11-07T05:31:56Z"
    },
    "total": 123,
    "returned": 123,
    "truncated": true,
    "warnings": [
      {
        "code": "no_data",
        "detail": "<string>"
      }
    ]
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

group_by · string · default: service

Field to group by: service, index, severity, or @ followed by an attribute key (e.g. @http.status_code). Defaults to service. Secret-shaped attribute keys (password, token, auth, cookie, session, ...) are rejected with invalid_parameter. Secret-shaped values are returned redacted with logs_query: null.

filter[query] · string

Logs explorer query, e.g. severity:error index:main.

filter[from] · string

Window start: ISO8601 or relative like now-6h, now-30m, now-2d. Defaults to now-1h. Windows are at most 7 days, and 24 hours without an indexable term.

filter[to] · string

Window end: ISO8601 or relative like now. Defaults to now.

page[size] · integer · default: 25

Number of top values to return (1-100, default 25). Not paginated: meta.truncated is true when more values matched.

Required range: 1 <= x <= 100

Response

200

application/json

Counts per value with the effective query and window

data · object[] · required

Show child attributes

meta · object · required

Show child attributes