Skip to main content
POST
Query in-cluster Loki log rows

Body

application/json

Request body for the Loki row query. Scope is resolved from whichever selector is provided — environmentId, moduleInstanceIds, logSourceKeys, or deploymentResourceId (one EKS workload) — exactly as the CloudWatch row query resolves its own. At least one is required. Only loki ui.logs sources are considered; CloudWatch sources in the same selection are ignored here and served by the CloudWatch endpoint, which is what lets a caller fan a single selection out across both.

endTime
string
required

Inclusive end of the query window (ISO 8601).

startTime
string
required

Inclusive start of the query window (ISO 8601).

deploymentResourceId
string | null

Scope to one EKS workload deployment resource. The server builds the LogQL selector from the workload's recorded namespace and name, so a caller never states a selector of its own. Must not be combined with environmentId, moduleInstanceIds, or logSourceKeys.

environmentId
string | null

Environment whose module-instance ui.logs sources are queried. Optional when moduleInstanceIds/logSourceKeys already name the sources.

filter
object

Structured filter predicate tree, compiled to LogQL server-side. Omit (or send {kind:"all"}) for no filter. Predicates LogQL cannot represent are dropped and reported in unsupported.

limit
integer<int32> | null

Max rows to return (default 1000, max 5000). Loki's own limit is applied per query and the result is the most recent rows in the window; page further back by re-querying with nextEndTimeMs as endTime.

logSourceKeys
string[] | null

Restrict to these individual ui.logs sources by composite <moduleInstanceId>::<logSourceId> key.

moduleInstanceIds
string[] | null

Restrict to these module instance ids.

Response

The request has succeeded.

Rows matching the query, plus what could not be answered. offlineClusters is the field that distinguishes this endpoint from its CloudWatch counterpart: a cluster whose Operator agent is not connected contributes no rows, and saying so by name is the difference between a user fixing their agent and a user believing their workload printed nothing.

missedSources
string[]
required

Composite <moduleInstanceId>::<logSourceId> keys whose query failed for a reason other than an offline agent.

nextEndTimeMs
integer<int64>
required

Pass this as the next request's endTime to page further back. Zero when the window is exhausted.

offlineClusters
string[]
required

Cluster ARNs whose Operator agent is not connected. Render this as an explicit state, not as an empty result.

partial
boolean
required

True when at least one source could not be queried, whether because its agent is offline or because its query failed.

resultCount
integer<int32>
required
rows
object[]
required
unsupported
string[]
required

Human-readable descriptions of filter predicates LogQL could not represent, so the UI can say which part of the query was dropped instead of silently widening it.