Explore documentation
  1. Welcome to Logs 👋
  2. Quick start guide
  3. Logs sources
    1. Programming languages
    2. Cloud platforms
    3. Web servers & Load balancers
    4. Operating systems
    5. Databases & Message queues
    6. Containers & Clusters
    7. Logging & Monitoring tools
    8. HTTP REST API
  4. Log Forwarding
    1. Vector (Recommended)
    2. Fluent Bit
    3. Logstash
    4. Fluentd
    5. Filebeat
    6. Syslog
  5. Dashboards
    1. SQL queries
    2. Query variables
    3. Transforming with JavaScript
    4. Alerts
  6. API
    1. Get started with Logs API
    2. Sources API
    3. Query API
  7. Using Logs
    1. AWS S3-compatible archive
    2. String + JSON format
    3. Formatting logs
    4. Live tail query language
    5. Explore logs with SQL
    6. Querying data in Better Stack

Query API

Fetch your Live Tail logs with a HTTP API.

Querying Live Tail returns rows based on your query. Each request returns a pagination.next url which you can query for more logs. Note that the URL contains a cursor query that works only when you don't change any query parameters, otherwise the behavior is not defined.

GET https://logs.betterstack.com/api/v1/query

Query parameters

source_ids
string

Comma-separated list of sources you want to query.

query
string

Filter logs with your query. This follows the same rules as Live tail. Read more about Live tail Query Language.

batch
integer

How many rows do you want to return? Accepts a range of 50-1000. Default: 100 rows.

from
string

Start of time range for the log query (ISO8601-formatted string: 2022-07-19T13:32:56+0000). Default: 30 minutes before to. If to is not specified then 30 minutes ago.

to
string

End of time range for the log query (ISO8601-formatted string: 2022-07-19T13:32:56+0000). Default: 30 minutes after from. If from is not specified then current time.

order
string

In what order do you want your logs? Possible values: newest_first, oldest_first. Default: newest_first

Headers

Authorization
required string

Bearer $TEAM_TOKEN

200

Returned rows

Response body

{
  "data": [
    {
      "app": "sample_app",
      "source_id": "123",
      "dt": "2022-07-19 12:28:14.000000",
      "event.http_request_received.port": null,
      "event.http_response_sent.status": null,
      "message": "Hello, world!",
      "level": "debug",
      "context.runtime.thread_id": "70039367973540",
      "context.system.pid": "14",
      "context.http.path": null,
      "context.http.method": null,
      "context.http.host": null,
      "context.http.remote_addr": null
    },
    {
      "app": "sample_app",
      "source_id": "123",
      "dt": "2022-07-19 12:28:14.000000",
      "event.http_request_received.port": null,
      "event.http_response_sent.status": null,
      "message": "Hello, world!",
      "level": "debug",
      "context.runtime.thread_id": "70182641597580",
      "context.system.pid": "14",
      "context.http.path": null,
      "context.http.method": null,
      "context.http.host": null,
      "context.http.remote_addr": null
    }
  ],
  "pagination": {
    "next": "https://logs.betterstack.com/api/v1/query?batch=100&cursor=MjE5PTI%3D&from=2022-07-18+12%3A29%3A14+UTC&order=newest_first&source_ids=123&to=2022-07-19+12%3A28%3A14+UTC"
  }
}

Example cURL

Example
curl --request GET \
  --url https://logs.betterstack.com/api/v1/query \
  --header "Authorization: Bearer $TEAM_TOKEN"

Previous article

Sources API response parameters

Next article

Archive your logs in AWS S3 or a compatible storage service.