Post Query Request
DescriptionCreates a log query
Request
URLURL
Header Parameters
Header Parameters
Request Body
{
"logQuery": "SELECT * FROM logs ORDER BY ingest_timestamp DESC"
}
End timestamp (milliseconds) for the query to be run
Start timestamp (milliseconds) for the query to be run
It represents the SQL query to be executed. All queries are run on and filtered by ingest_timestamp by default, but you can query logs on log_timestamp also. To run any query on log_timestamp, add the keyword log_timestamp in the ORDER BY clause.
For example:
Below query returns results filtered by ingest_timestamp:
SELECT * FROM logs WHERE text=‘error’ ORDER BY ingest_timestamp DESC
Below query returns results filtered by log_timestamp:
SELECT * FROM logs WHERE text=‘error’ ORDER BY log_timestamp DESC
Note: Query by log_timestamp is only valid for indexed partitions.
Temporary to support low cost queries till archive configs are added as partitions in lint-control-plane
Page number for current page of results, set when constructing a query during next page handling.
Relative URI path of the service managing this document. Can be a complete link, or just a request ID.
Dynamic fields that need to be used in the SQL query (without creating extracted fields)
OrgId for which telemetry data is to be queried
Callback URL called when query is complete
Only used for low cost queries. Strictly for internal use (Will not be exposed to the user) Number of data planes the query should run on
PartitionIds from where we need the response. This might be removed once we figure out an intelligent way to distinguish the partitions from the query constraints. This is done for testing the partition flow for query
Number of rows to be returned
Payload sent to callbackUrl
Subject to filter based on specified user
Authorization links associated with this request
Authentication
Response
Response BodyResponse Body
200 OK
{
"aggregateRecordCount": 0,
"bytesProcessed": 0,
"bytesQueried": 0,
"bytesReturned": 0,
"bytesScanned": 0,
"callbackPayload": "string",
"callbackUrl": "string",
"clientOrgId": "string",
"createdAt": "string",
"createdBy": "string",
"currentPageNumber": 0,
"documentSelfLink": "string",
"dynamicFields": [
{
"constraints": {
"constraints": [
{
"fieldName": "text",
"operator": "CONTAINS",
"value": "error"
}
],
"fieldName": "string",
"operator": "AND",
"tags": [
"string"
],
"value": "string"
},
"contentPackId": "string",
"createdAt": "string",
"createdBy": "string",
"fieldType": "string",
"fullRegex": "string",
"id": "string",
"internalName": "string",
"lastUpdatedAt": "string",
"lastUpdatedBy": "string",
"name": "string",
"orgId": "string",
"postValue": "string",
"preValue": "string",
"sampleMessage": "string",
"shortName": "string",
"smartFieldId": "string",
"value": "string"
}
],
"end": 0,
"extractedFieldsEvaluation": {
"contentPackIdsToInclude": [
"string"
],
"includeAllFields": false
},
"failureMessage": "string",
"id": "string",
"logQuery": "string",
"logQueryResults": [
"string"
],
"logQueryTelemetry": {
"aggregateQuery": false,
"dynamicFieldsQuery": false,
"errorMessage": "string",
"indexType": "INDEXED",
"lintAppEndTime": 0,
"lintAppStartTime": 0,
"logQuery": "string",
"numberOfCoresQueried": 0,
"numberOfExtractedFieldsEvaluated": 0,
"orgId": "string",
"partitionIdsInRequest": [
"string"
],
"queryAgent": "UI_DASHBOARDS",
"queryConstraintStr": "string",
"queryEndTime": 0,
"queryExecutionTime": 0,
"queryPostProcessingTime": 0,
"queryRange": 0,
"queryStartTime": 0,
"requestId": "string",
"storageState": "string",
"subscriptionType": "PRE_TRIAL",
"taskStage": "CREATED",
"tenantId": "string",
"totalSizeQueriedBytes": 0,
"type": "EVENTS",
"userName": "string"
},
"nextPageLink": "string",
"parallelizationFactor": 0,
"partialResults": false,
"partitionIds": [
"string"
],
"processedResults": [
{
"annotations": [
{
"description": "string",
"name": "string",
"url": "string"
}
],
"data": {
"key": "string"
},
"positions": {
"key": {
"length": 0,
"start": 0
}
},
"supplementalData": {
"key": "string"
}
}
],
"queryProgress": {
"coresClosed": "string",
"coresRequested": "string",
"coresResponded": "string",
"failureMessage": "string",
"numCoresClosed": 0,
"numCoresRequested": 0,
"numCoresResponded": 0,
"queryElapsedTimeMillis": 0,
"queryPercentComplete": 0,
"queryRemainingTimeMillis": 0,
"queryStartTimeMillis": 0,
"subQueriesComplete": 0,
"subQueriesTotal": 0,
"trackerId": "string"
},
"rows": 0,
"start": 0,
"sub": "string",
"taskInfo": {
"durationMicros": 0,
"failure": {
"statusCode": 0
},
"isDirect": false,
"stage": "CREATED"
},
"tenantAgnostic": false,
"tenantLinks": [
"string"
],
"totalMatchedRecordCount": 0,
"totalRecordCount": 0,
"trackerId": "string"
}
End timestamp (milliseconds) for the query to be run
Start timestamp (milliseconds) for the query to be run
SQL query to be executed
A simple implementation of HAL(Hypertext Application Language) formatted HATEOAS links
Total size of high-cost queries
Number of bytes of records of payload data returned by Amazon S3 based on filter conditions
Number of bytes processed before being uncompressed
Payload sent to callbackUrl
Callback URL called when query is complete
OrgId for which telemetry data is to be queried
ISO8601 date string that informs when this query was created
Email ID of the user who created this query
Page number for current page of results, set when constructing a query during next page handling.
Relative URI path of the service managing this document. Can be a complete link, or just a request ID.
Dynamic fields that need to be used in the SQL query (without creating extracted fields)
Number of bytes processed after being uncompressed
This message indicates failure if query processing fails
A unique identifier associated with the log query
Temporary to support low cost queries till archive configs are added as partitions in lint-control-plane
Unprocessed query results from the control plane query at the most recent retrieval call
Link to the next page
Only used for low cost queries. Strictly for internal use (Will not be exposed to the user) Number of data planes the query should run on
Indicates whether or not the results are a complete set. The field is set if the EOF record is returned from the data platform and contains the field is_result_partial
PartitionIds from where we need the response. This might be removed once we figure out an intelligent way to distinguish the partitions from the query constraints. This is done for testing the partition flow for query
Number of rows to be returned
For aggregated queries: Total number of records returned in the response,For non-aggregated queries: This field is not set
Subject to filter based on specified user
The state used to track the progress of the query task. This value should not be modified
Authorization links associated with this request
Total number of records that matched the query. This is not necessarily the number of records returned in the response
For non-aggregated queries: Total number of records returned in the response,For aggregated queries: Total number of records before aggregation was applied
Tracker identifier to track execution
