Querying Logs

Querying logs

Use a credential with logs:read for the destination resource. A sender token with only logs:write cannot query events.

curl --fail-with-body --get \
  "$ALSHIVAL_BASE_URL/v1/workspaces/$ALSHIVAL_WORKSPACE_ID/resources/$ALSHIVAL_RESOURCE_ID/logs" \
  -H "Authorization: Bearer $ALSHIVAL_READ_TOKEN" \
  --data-urlencode 'severity=ERROR' \
  --data-urlencode 'q=timeout' \
  --data-urlencode 'limit=50'

Filters and pagination

Parameter	Behavior
start, end	Time bounds; use timezone-aware ISO timestamps such as 2026-10-12T00:00:00Z.
severity	One canonical uppercase severity.
q	Message search, up to 500 characters.
trace_id	Exact 32-character lowercase hexadecimal trace ID.
limit	1–200; default 100.
cursor	Opaque continuation returned by the same destination.

Responses contain items, next_cursor, and retention. Pass next_cursor as the next request's cursor, preserving the original filters. Stop when it is null. Start a fresh query to see newer arrivals. Do not decode cursors or reuse them across destinations or resources.

Cloud retention depends on workspace policy and quotas. Local logs use device retention and disk limits. A successful empty query can mean filters excluded the events or retention removed them; it does not prove ingestion failed.

---

Published from the versioned Alshival documentation source. Edit the source rather than this generated page.