> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Query in-cluster Loki log rows > Query rows from the in-cluster Loki behind each selected loki ui.logs source, through the Operator agent. POST /logs/eks-loki in the Ravion API reference. ## OpenAPI ````yaml https://api.ravion.com/openapi.yaml post /logs/eks-loki openapi: 3.0.0 info: title: Ravion version: 0.0.0 servers: - url: https://api.ravion.com security: - BearerAuth: [] tags: - name: Projects - name: Environments - name: Pipelines - name: PipelineRuns - name: TerraformResources - name: TerraformExecutionSummaries - name: PipelineStepExecutions - name: AwsCloudWatch - name: PipelineVersions - name: Organizations - name: Stacks - name: StackWorkspaces - name: Auth - name: OAuth - name: User - name: Health - name: Memberships - name: ServiceAccounts - name: AwsDefaultNetworks - name: AwsAccounts - name: ApiKeys - name: AwsAmp - name: EksPrometheus - name: EksLoki - name: ExecutionEnvironments - name: ModuleDefinitions - name: ModuleCategories - name: ModuleVersions - name: ModuleInstances - name: DefaultValueDefinitions - name: DefaultValues - name: CodeSources - name: Github - name: Gitlab - name: Git - name: Values - name: Deployments - name: DeploymentResources - name: InfrastructureEvents - name: WebSocket - name: Domains - name: AcmCertificates - name: Describe - name: Reports paths: /logs/eks-loki: post: tags: - EksLoki summary: Query in-cluster Loki log rows description: >- Query rows from the in-cluster Loki behind each selected `loki` ui.logs source, through the Operator agent. POST rather than GET because the filter is a recursive model that cannot ride query params, exactly as with the CloudWatch row query. operationId: GetEksLokiLogs requestBody: content: application/json: schema: $ref: '#/components/schemas/EksLokiLogsRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/EksLokiLogsResponse' description: The request has succeeded. '400': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: The request is invalid or malformed. '404': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: The server cannot find the requested resource. '422': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: Client error '500': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: Server error components: schemas: EksLokiLogsRequest: additionalProperties: false description: >- Request body for the Loki row query. Scope is resolved from whichever selector is provided — `environmentId`, `moduleInstanceIds`, `logSourceKeys`, or `deploymentResourceId` (one EKS workload) — exactly as the CloudWatch row query resolves its own. At least one is required. Only `loki` ui.logs sources are considered; CloudWatch sources in the same selection are ignored here and served by the CloudWatch endpoint, which is what lets a caller fan a single selection out across both. properties: deploymentResourceId: description: >- Scope to one EKS workload deployment resource. The server builds the LogQL selector from the workload's recorded namespace and name, so a caller never states a selector of its own. Must not be combined with `environmentId`, `moduleInstanceIds`, or `logSourceKeys`. nullable: true type: string endTime: description: Inclusive end of the query window (ISO 8601). type: string environmentId: description: >- Environment whose module-instance ui.logs sources are queried. Optional when `moduleInstanceIds`/`logSourceKeys` already name the sources. nullable: true type: string filter: allOf: - $ref: '#/components/schemas/CloudWatchLogFilter' description: >- Structured filter predicate tree, compiled to LogQL server-side. Omit (or send `{kind:"all"}`) for no filter. Predicates LogQL cannot represent are dropped and reported in `unsupported`. limit: description: >- Max rows to return (default 1000, max 5000). Loki's own `limit` is applied per query and the result is the most recent rows in the window; page further back by re-querying with `nextEndTimeMs` as `endTime`. format: int32 nullable: true type: integer logSourceKeys: description: >- Restrict to these individual ui.logs sources by composite `::` key. items: type: string nullable: true type: array moduleInstanceIds: description: Restrict to these module instance ids. items: type: string nullable: true type: array startTime: description: Inclusive start of the query window (ISO 8601). type: string required: - startTime - endTime type: object EksLokiLogsResponse: additionalProperties: false description: >- Rows matching the query, plus what could not be answered. `offlineClusters` is the field that distinguishes this endpoint from its CloudWatch counterpart: a cluster whose Operator agent is not connected contributes no rows, and saying so by name is the difference between a user fixing their agent and a user believing their workload printed nothing. properties: missedSources: description: >- Composite `::` keys whose query failed for a reason other than an offline agent. items: type: string type: array nextEndTimeMs: description: >- Pass this as the next request's `endTime` to page further back. Zero when the window is exhausted. format: int64 type: integer offlineClusters: description: >- Cluster ARNs whose Operator agent is not connected. Render this as an explicit state, not as an empty result. items: type: string type: array partial: description: >- True when at least one source could not be queried, whether because its agent is offline or because its query failed. type: boolean resultCount: format: int32 type: integer rows: items: $ref: '#/components/schemas/EksLokiLogRow' type: array unsupported: description: >- Human-readable descriptions of filter predicates LogQL could not represent, so the UI can say which part of the query was dropped instead of silently widening it. items: type: string type: array required: - rows - nextEndTimeMs - partial - missedSources - offlineClusters - resultCount - unsupported type: object Errors.UserFacingErrorData: additionalProperties: false description: |- User-facing error presentation data. This is what the API returns to the frontend after formatting ErrorData using CEL templates from the error registry. Used for both: - Error fields on domain models (e.g., PipelineRun.error) - API error response bodies (HTTP 4xx/5xx responses) properties: action: allOf: - $ref: '#/components/schemas/Errors.Action' description: Optional action to help resolve the error code: description: Full error code, e.g., "Ravion:Pipeline:NOT_FOUND" type: string description: description: Additional description with more details type: string details: description: Structured details rendered as user-facing sections. items: $ref: '#/components/schemas/Errors.UserFacingErrorDetailSection' type: array isInternal: description: >- Indicates whether this error is internal (only set when ShowInternal=true). This allows SUPERADMINs to identify internal errors while viewing full details. type: boolean message: description: Main error message (required) type: string metadata: additionalProperties: {} description: >- Error params/metadata. Stripped for internal errors unless superadmin. type: object requestId: description: Request ID for correlating errors with server logs. type: string required: - code - message type: object CloudWatchLogFilter: additionalProperties: false description: >- One node in the structured log-filter predicate tree. `kind` discriminates the node; the other fields are populated per kind. The empty filter is `{kind:"all"}`. This is the wire form of the LogSearch AST — the server translates it into the source's query language (CloudWatch Logs Insights today), so negation/OR/grouping are honored server-side rather than dropped on the client. properties: filter: allOf: - $ref: '#/components/schemas/CloudWatchLogFilter' description: Child predicate for a `not` node. filters: description: Child predicates for `and` / `or` nodes. items: $ref: '#/components/schemas/CloudWatchLogFilter' type: array kind: description: >- Node kind: `all` (match everything) | `and` | `or` | `not` | `field` | `text`. type: string operator: description: >- Match operator for a `field` node: `eq` | `neq` | `contains` | `regex` | `gt` | `gte` | `lt` | `lte`. (Named `operator`, not `op`, because `op` is a TypeSpec keyword.) type: string path: description: >- Field path for a `field` node. The well-known paths `level` and `stream` route to dedicated channels (classified level / `@logStream`); any other path matches a JSON key:value fragment in `@message`. type: string value: description: >- Literal value for a `field` or `text` node. Shipped RAW — the server does all escaping. type: string required: - kind type: object EksLokiLogRow: additionalProperties: false description: >- A single log line from an in-cluster Loki. Field-for-field parallel to `CloudWatchLogInsightsRow` so a client merging both sources into one table has one row shape to render, with `stream` carrying the LogQL stream identity rather than a CloudWatch log-stream name. properties: eventId: description: Stable identifier for de-duplication across overlapping pages. type: string level: description: >- Classified level: `debug` | `info` | `warn` | `error`. Taken from the `level` structured-metadata label the addons collector attaches when present, and otherwise classified from the line by the same rules the CloudWatch path uses — so the two sources agree about what an error is. type: string logSourceId: description: >- ui.logs source id within that instance. Empty for rows matched through `deploymentResourceId`. type: string message: description: The log line as the workload printed it. type: string sourceId: description: >- Module instance the matched ui.logs source belongs to. Empty for rows matched through `deploymentResourceId`. type: string stream: description: >- Human-readable identity of the Loki stream the line came from, rendered from its labels (e.g. `production/api`). Fills the same column as CloudWatch's `logStream`. type: string timestamp: description: Line timestamp, epoch milliseconds. format: int64 type: integer required: - timestamp - message - stream - sourceId - logSourceId - level type: object Errors.Action: additionalProperties: false description: Action to help user resolve the error properties: label: description: Button/link label text type: string url: description: URL to navigate to for resolution type: string required: - label - url type: object Errors.UserFacingErrorDetailSection: additionalProperties: false description: Structured user-facing error detail section. properties: items: description: List of detail values for this section. items: type: string type: array object: additionalProperties: {} description: Structured detail payload for object rendering. type: object render: description: Rendering hint for clients. Valid values are list or object. type: string title: description: Detail section title shown in the UI. type: string required: - title - render type: object securitySchemes: BearerAuth: scheme: Bearer type: http ````