Query CloudWatch Logs Insights rows
Run CloudWatch Logs Insights over a selected set of module-instance ui.logs sources, filtered by a structured predicate tree. Returns normalized log rows (paged via nextEndTimeMs). The histogram is a SEPARATE endpoint so rows render without waiting for the full-window aggregation. POST (not GET) because the filter is a recursive model that can’t ride query params.
Body
Request body for the Logs Insights query. Scope is resolved from whichever selector is provided — environmentId (all of an environment's instances), moduleInstanceIds, and/or logSourceKeys — so the endpoint is not tied to one entity type. At least one is required.
Inclusive end of the query window (ISO 8601)
Inclusive start of the query window (ISO 8601)
Return every row in the window (up to the 10000 maximum) rather than a single page. Use this for a small, recent window — e.g. a live tail polling for new rows since the last one it saw — so the caller doesn't have to page.
Environment whose module-instance ui.logs sources are queried. Optional: omit it when moduleInstanceIds and/or logSourceKeys already name the sources to query.
Structured filter predicate tree applied to the matched sources. Omit (or send {kind:"all"}) for no filter. Negation, OR and grouping are honored server-side; predicates the source can't represent are dropped and reported in the response's unsupported.
Max rows to return (default 1000, max 10000). The row list is the most recent limit rows in the window; page further back by re-querying with nextEndTimeMs as the endTime.
Restrict to these individual ui.logs sources, each a composite <moduleInstanceId>::<logSourceId> key (the ui.logs source id is unique only within an instance). When set, only the named sources are queried — a finer filter than moduleInstanceIds, which it overrides for the listed instances. May be supplied without environmentId.
Restrict to these module instance ids. Combined with environmentId it narrows to a subset; supplied WITHOUT environmentId it selects exactly these instances. Omit to query every instance in environmentId.
Response
The request has succeeded.
Response payload for a CloudWatch Logs Insights ROW query (the histogram is a separate endpoint).
Log groups of the sources that could not be queried for this request (empty unless partial is true). Surface these so the user knows exactly which sources are missing from the result.
Epoch-millis cursor for the NEXT (older) page: re-query with the same startTime and this value as endTime. 0 means there are no older rows to load. Computed server-side from the raw coverage boundary (not the post-filter row count), so a narrow level filter — or sources of differing density — never makes a short page look like the end of the data.
True when one or more selected log sources could not be queried (e.g. an account's credentials failed), so the rows omit those sources. The affected sources are listed in missedSources. This is NOT set for paging — the row list is complete up to limit, with older rows reachable via nextEndTimeMs.
Total number of rows returned
Merged, time-sorted (desc) log rows across all selected sources.
Human-readable reasons for filter predicates the server could not represent on this source and therefore did NOT apply (e.g. numeric ranges). When non-empty the result is BROADER than the submitted filter — surface a warning. Empty when the whole filter was applied.