Skip to main content
POST
Search cluster logs

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

cluster_id
string<uuid>
required

The cluster.

Body

application/json
start
string
end
string
since
string
raw_query
string
direction
string
namespaces
string[]
pods
string[]
containers
string[]
source
enum<string>
default:auto

Read auto (connected source first, hosted only when no source is connected), connected only, or Ankra hosted logs only. An explicit choice never switches on empty results or failure and does not alter the saved connection.

Available options:
auto,
connected,
ankra_hosted
limit
integer
include_record
boolean
default:false

Also return each entry's record: the application's own structured line as stored, without the log shipper's envelope (Kubernetes metadata, stream, cluster and tenant fields). Elasticsearch/OpenSearch and VictoriaLogs only; long values are cut.

Response

Scoped log search results.

provider
string
source
string

ankra_hosted when Ankra hosted logs answered; absent for a connected source.

note
string
entries
object[]
total_hits
integer
total_hits_relation
enum<string>
Available options:
eq,
gte
truncated
boolean
start
string
end
string
cluster_attribution
object