List Observability logs

Search Rootly Observability logs with the Logs explorer query syntax (service:, severity:, index:, trace_id:, @attribute:value, OR inside field groups, - negation, * prefix, free text). Rows are newest first, clipped and redacted. meta.query and meta.window echo the effective query and window. Requires a personal or Global API key (Team API Keys are group-scoped and get 403 unsupported_api_key) or an OAuth token with the obs.logs:read (or all) scope, and the Observability logs read permission. A Global API key uses its service user’s Observability role, which starts as the team’s default Observability role. Limited to 60 requests per minute per token; on this endpoint the X-RateLimit-* headers report that per-minute budget, not the default API limit. Every 429 returns the errors envelope with code rate_limited and a Retry-After header.

GET /v1/observability/logs

List Observability logs

cURL

curl --request GET \
  --url https://api.rootly.com/v1/observability/logs \
  --header 'Authorization: Bearer <token>'

200

{
  "data": [
    {
      "id": "<string>",
      "type": "observability_logs",
      "attributes": {
        "timestamp": "2023-11-07T05:31:56Z",
        "service": "<string>",
        "index": "<string>",
        "severity": "<string>",
        "body": "<string>",
        "trace_id": "<string>",
        "span_id": "<string>",
        "pattern_hash": "<string>",
        "attributes": {},
        "resource_attributes": {}
      }
    }
  ],
  "meta": {
    "query": "<string>",
    "window": {
      "from": "2023-11-07T05:31:56Z",
      "to": "2023-11-07T05:31:56Z"
    },
    "returned": 123,
    "truncated": true,
    "warnings": [
      {
        "code": "no_data",
        "detail": "<string>"
      }
    ],
    "page": {
      "size": 123,
      "next_cursor": "<string>"
    }
  },
  "links": {
    "next": "<string>"
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

filter[query] · string

Logs explorer query, e.g. service:checkout severity:error index:main.

filter[from] · string

Window start: ISO8601 or relative like now-6h, now-30m, now-2d. Defaults to now-1h. Windows are at most 7 days, and 24 hours without an indexable term.

filter[to] · string

Window end: ISO8601 or relative like now. Defaults to now.

page[size] · integer · default: 25

Maximum rows per page (1-50, default 25). A page can hold fewer rows when the response size budget is reached; keep paging while meta.page.next_cursor is present.

Required range: 1 <= x <= 50

page[cursor] · string

meta.page.next_cursor from the previous page. Keeps that page's window; send the same filter[query].

Response

200

application/json

Log rows with the effective query and window

data · object[] · required

Show child attributes

meta · object · required

Show child attributes

links · object · required

Show child attributes