Logs API Reference

FuseQL queries

FuseQL queries support the full FuseQL operator set including aggregation, parsing, string manipulation, and IP operators. Use these endpoints when you want to run FuseQL pipelines — parse, where, count, avg, timeslice, lookup, and so on — against your log data.

getLogMetricsResultWithKfuseQl

Returns an aggregated metrics result for the specified time range using the FuseQL engine. Use this for any FuseQL query that groups, aggregates, or uses timeslice — the full FuseQL operator set is available.

Parameters:

Response fields (FuseQLQueryResult):

Count all logs in a one-hour window

curl -H "Authorization: Bearer <sa-token>" \
     -H "Content-Type: application/json" \
     -X POST "https://<your-instance>/query" \
     -d '{\n       "query": "{ getLogMetricsResultWithKfuseQl(query: \"* | timeslice 5m | count by (_timeslice)\", startTs: \"2026-06-27T03:56:36Z\", endTs: \"2026-06-27T04:56:36Z\") { AggrValues ColumnHeaders GroupKeys TimeKey TableResult UrlValues } }"\n     }'

Count error logs grouped by source

curl -H "Authorization: Bearer <sa-token>" \
     -H "Content-Type: application/json" \
     -X POST "https://<your-instance>/query" \
     -d '{\n       "query": "{ getLogMetricsResultWithKfuseQl(query: \"level=\\\"error\\\" | count by (source)\", startTs: \"2026-06-27T03:56:36Z\", endTs: \"2026-06-27T04:56:36Z\") { ColumnHeaders TableResult } }"\n     }'

getLogsWithFuseQlStream

Returns raw log rows for the specified time range using the FuseQL engine. Results are paginated: the response includes a Cursor value to pass in subsequent requests. When Cursor is an empty string, there are no more results.

Parameters:

Fetch the first page of logs from a source

curl -H "Authorization: Bearer <sa-token>" \
     -H "Content-Type: application/json" \
     -X POST "https://<your-instance>/query" \
     -d '{\n       "query": "subscription { getLogsWithFuseQlStream(query: \"source=\\\"grafana\\\" | limit 2\", startTs: \"2026-06-27T03:56:36Z\", endTs: \"2026-06-27T04:56:36Z\", cursor: null) { ColumnHeaders TableResult Cursor } }"\n     }'

LogQL queries

The following APIs use the LogQL query engine for log retrieval and facet analysis. Use these when you need to filter logs using LogQL syntax or retrieve facet and label values.

getFacetValueCountsStream

Get count facet values for the specified time range, with filter support.

Syntax

subscription { (1)
  getFacetValueCountsStream(
    facetName: String! (2)
    dataType: String (3)
    logQuery: LogQuery (4)
    timestamp: Time (5)
    durationSecs: Int (6)
    limit: Int (7)
    timeoutSecs: Int (8)
    options: String (9)
  ): ValueCountList! (10)
}

getLabelValuesStream

Get label values for the specified label name.

Syntax

subscription { (1)
  getLabelValuesStream(
  labelName: String! (2)
  logQuery: LogQuery (3)
  timestamp: Time (4)
  durationSecs: Int (5)
  includeCount: Boolean (6)
  limit: Int (7)
  contains: String (8)
  timeoutSecs: Int (9)
  options: String (10)
): ValueCountList! (11)
}

Error handling

GraphQL errors are returned with HTTP 200 in an errors array alongside a null data value:

{
  "errors": [\
    {\
      "message": "syntax error",\
      "path": ["getLogMetricsResultWithKfuseQl"]\
    }\
  ],
  "data": {
    "getLogMetricsResultWithKfuseQl": null
  }
}

Common error causes: