Query in-cluster Loki log rows
Query rows from the in-cluster Loki behind each selected loki ui.logs source, through the Operator agent. POST /logs/eks-loki in the Ravion API reference.
Body
Request body for the Loki row query. Scope is resolved from whichever selector is provided — environmentId, moduleInstanceIds, logSourceKeys, or deploymentResourceId (one EKS workload) — exactly as the CloudWatch row query resolves its own. At least one is required. Only loki ui.logs sources are considered; CloudWatch sources in the same selection are ignored here and served by the CloudWatch endpoint, which is what lets a caller fan a single selection out across both.
Inclusive end of the query window (ISO 8601).
Inclusive start of the query window (ISO 8601).
Scope to one EKS workload deployment resource. The server builds the LogQL selector from the workload's recorded namespace and name, so a caller never states a selector of its own. Must not be combined with environmentId, moduleInstanceIds, or logSourceKeys.
Environment whose module-instance ui.logs sources are queried. Optional when moduleInstanceIds/logSourceKeys already name the sources.
Structured filter predicate tree, compiled to LogQL server-side. Omit (or send {kind:"all"}) for no filter. Predicates LogQL cannot represent are dropped and reported in unsupported.
Max rows to return (default 1000, max 5000). Loki's own limit is applied per query and the result is the most recent rows in the window; page further back by re-querying with nextEndTimeMs as endTime.
Restrict to these individual ui.logs sources by composite <moduleInstanceId>::<logSourceId> key.
Restrict to these module instance ids.
Response
The request has succeeded.
Rows matching the query, plus what could not be answered. offlineClusters is the field that distinguishes this endpoint from its CloudWatch counterpart: a cluster whose Operator agent is not connected contributes no rows, and saying so by name is the difference between a user fixing their agent and a user believing their workload printed nothing.
Composite <moduleInstanceId>::<logSourceId> keys whose query failed for a reason other than an offline agent.
Pass this as the next request's endTime to page further back. Zero when the window is exhausted.
Cluster ARNs whose Operator agent is not connected. Render this as an explicit state, not as an empty result.
True when at least one source could not be queried, whether because its agent is offline or because its query failed.
Human-readable descriptions of filter predicates LogQL could not represent, so the UI can say which part of the query was dropped instead of silently widening it.