Skip to main content
POST
Query CloudWatch Logs Insights rows

Body

application/json

Request body for the Logs Insights query. Scope is resolved from whichever selector is provided — environmentId (all of an environment's instances), moduleInstanceIds, and/or logSourceKeys — so the endpoint is not tied to one entity type. At least one is required.

endTime
string
required

Inclusive end of the query window (ISO 8601)

startTime
string
required

Inclusive start of the query window (ISO 8601)

complete
boolean | null

Return every row in the window (up to the 10000 maximum) rather than a single page. Use this for a small, recent window — e.g. a live tail polling for new rows since the last one it saw — so the caller doesn't have to page.

environmentId
string | null

Environment whose module-instance ui.logs sources are queried. Optional: omit it when moduleInstanceIds and/or logSourceKeys already name the sources to query.

filter
object

Structured filter predicate tree applied to the matched sources. Omit (or send {kind:"all"}) for no filter. Negation, OR and grouping are honored server-side; predicates the source can't represent are dropped and reported in the response's unsupported.

limit
integer<int32> | null

Max rows to return (default 1000, max 10000). The row list is the most recent limit rows in the window; page further back by re-querying with nextEndTimeMs as the endTime.

logSourceKeys
string[] | null

Restrict to these individual ui.logs sources, each a composite <moduleInstanceId>::<logSourceId> key (the ui.logs source id is unique only within an instance). When set, only the named sources are queried — a finer filter than moduleInstanceIds, which it overrides for the listed instances. May be supplied without environmentId.

moduleInstanceIds
string[] | null

Restrict to these module instance ids. Combined with environmentId it narrows to a subset; supplied WITHOUT environmentId it selects exactly these instances. Omit to query every instance in environmentId.

Response

The request has succeeded.

Response payload for a CloudWatch Logs Insights ROW query (the histogram is a separate endpoint).

missedSources
string[]
required

Log groups of the sources that could not be queried for this request (empty unless partial is true). Surface these so the user knows exactly which sources are missing from the result.

nextEndTimeMs
integer<int64>
required

Epoch-millis cursor for the NEXT (older) page: re-query with the same startTime and this value as endTime. 0 means there are no older rows to load. Computed server-side from the raw coverage boundary (not the post-filter row count), so a narrow level filter — or sources of differing density — never makes a short page look like the end of the data.

partial
boolean
required

True when one or more selected log sources could not be queried (e.g. an account's credentials failed), so the rows omit those sources. The affected sources are listed in missedSources. This is NOT set for paging — the row list is complete up to limit, with older rows reachable via nextEndTimeMs.

resultCount
integer<int32>
required

Total number of rows returned

rows
object[]
required

Merged, time-sorted (desc) log rows across all selected sources.

unsupported
string[]
required

Human-readable reasons for filter predicates the server could not represent on this source and therefore did NOT apply (e.g. numeric ranges). When non-empty the result is BROADER than the submitted filter — surface a warning. Empty when the whole filter was applied.