curl --request GET \
--url https://api.example.com/api/logs/search \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.example.com/api/logs/search"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.example.com/api/logs/search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/logs/search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/logs/search"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/api/logs/search")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/logs/search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"eventMessage": "<string>",
"timestamp": "<string>",
"body": {},
"source": "<string>"
}
][
{
"id": "<string>",
"eventMessage": "<string>",
"timestamp": "<string>",
"body": {},
"source": "<string>"
}
]{
"error": "INVALID_INPUT",
"message": "Search query parameter (q) is required",
"statusCode": 400
}{
"error": "AUTH_INVALID_CREDENTIALS",
"message": "Unauthorized",
"statusCode": 401
}{
"error": "AUTH_UNAUTHORIZED",
"message": "Admin access required",
"statusCode": 403
}Search logs
Paginates through paginatedResponse, so responses use 206 with
Content-Range when the page is a subset and 200 when it is not.
How far that contract holds depends on the configured log provider.
The local provider slices the full result set, so offset and the
total in Content-Range behave as expected. The CloudWatch provider
cannot express offset in an Insights query: it ignores offset and
reports the length of the returned page as the total. Paging past
the first page there repeats results, so treat this endpoint as
single-page unless the deployment uses the local provider.
curl --request GET \
--url https://api.example.com/api/logs/search \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.example.com/api/logs/search"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.example.com/api/logs/search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/logs/search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/logs/search"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/api/logs/search")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/logs/search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"eventMessage": "<string>",
"timestamp": "<string>",
"body": {},
"source": "<string>"
}
][
{
"id": "<string>",
"eventMessage": "<string>",
"timestamp": "<string>",
"body": {},
"source": "<string>"
}
]{
"error": "INVALID_INPUT",
"message": "Search query parameter (q) is required",
"statusCode": 400
}{
"error": "AUTH_INVALID_CREDENTIALS",
"message": "Unauthorized",
"statusCode": 401
}{
"error": "AUTH_UNAUTHORIZED",
"message": "Admin access required",
"statusCode": 403
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Query Parameters
Search query
Restrict the search to one source
Ignored by the CloudWatch provider; see the description above
Was this page helpful?