> ## Documentation Index
> Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Stream in-cluster Loki logs (SSE)

> Stream one Loki log source live over SSE: recent history first, then Loki's own /loki/api/v1/tail WebSocket bridged over the Operator substream.



## OpenAPI

````yaml https://api.ravion.com/openapi.yaml get /logs/eks-loki/stream
openapi: 3.0.0
info:
  title: Ravion
  version: 0.0.0
servers:
  - url: https://api.ravion.com
security:
  - BearerAuth: []
tags:
  - name: Projects
  - name: Environments
  - name: Pipelines
  - name: PipelineRuns
  - name: TerraformResources
  - name: TerraformExecutionSummaries
  - name: PipelineStepExecutions
  - name: AwsCloudWatch
  - name: PipelineVersions
  - name: Organizations
  - name: Stacks
  - name: StackWorkspaces
  - name: Auth
  - name: OAuth
  - name: User
  - name: Health
  - name: Memberships
  - name: ServiceAccounts
  - name: AwsDefaultNetworks
  - name: AwsAccounts
  - name: ApiKeys
  - name: AwsAmp
  - name: EksPrometheus
  - name: EksLoki
  - name: ExecutionEnvironments
  - name: ModuleDefinitions
  - name: ModuleCategories
  - name: ModuleVersions
  - name: ModuleInstances
  - name: DefaultValueDefinitions
  - name: DefaultValues
  - name: CodeSources
  - name: Github
  - name: Gitlab
  - name: Git
  - name: Values
  - name: Deployments
  - name: DeploymentResources
  - name: InfrastructureEvents
  - name: WebSocket
  - name: Domains
  - name: AcmCertificates
  - name: Describe
  - name: Reports
paths:
  /logs/eks-loki/stream:
    get:
      tags:
        - EksLoki
      summary: Stream in-cluster Loki logs (SSE)
      description: >-
        Stream one Loki log source live over SSE: recent history first, then
        Loki's own `/loki/api/v1/tail` WebSocket bridged over the Operator
        substream. The source is named by its composite
        `<moduleInstanceId>::<logSourceId>` key, or by an EKS workload
        deployment resource — never by a cluster ARN and never by a raw
        selector, so the destination is always one the server derived from a
        record the caller is authorized to read.
      operationId: StreamEksLokiLogs
      parameters:
        - description: >-
            Composite `<moduleInstanceId>::<logSourceId>` key of the ui.logs
            source to tail. Mutually exclusive with `deploymentResourceId`.
          in: query
          name: logSourceKey
          schema:
            nullable: true
            type: string
        - description: >-
            EKS workload deployment resource to tail. Mutually exclusive with
            `logSourceKey`.
          in: query
          name: deploymentResourceId
          schema:
            nullable: true
            type: string
        - description: >-
            Inclusive start of the historical phase (ISO 8601). Defaults to
            fifteen minutes before now.
          in: query
          name: startTime
          schema:
            nullable: true
            type: string
        - description: Inclusive end of the historical phase (ISO 8601). Defaults to now.
          in: query
          name: endTime
          schema:
            nullable: true
            type: string
        - description: Continue into a live tail after the historical phase.
          in: query
          name: tail
          schema:
            nullable: true
            type: boolean
        - description: >-
            Case-sensitive substring the line must contain, compiled to a LogQL
            line filter. A plain string rather than the structured filter tree
            because a recursive model cannot ride a query param on an SSE GET.
          in: query
          name: search
          schema:
            nullable: true
            type: string
      responses:
        '200':
          content:
            text/event-stream:
              schema:
                $ref: '#/components/schemas/EksLokiLogBatchEvent'
          description: SSE stream of Loki log events.
components:
  schemas:
    EksLokiLogBatchEvent:
      additionalProperties: false
      description: A batch of Loki log lines delivered on the SSE tail.
      properties:
        events:
          items:
            $ref: '#/components/schemas/EksLokiLogRow'
          type: array
        isFinal:
          description: >-
            True on the final batch of the historical phase, before the live
            tail takes over.
          type: boolean
      required:
        - events
        - isFinal
      type: object
    EksLokiLogRow:
      additionalProperties: false
      description: >-
        A single log line from an in-cluster Loki. Field-for-field parallel to
        `CloudWatchLogInsightsRow` so a client merging both sources into one
        table has one row shape to render, with `stream` carrying the LogQL
        stream identity rather than a CloudWatch log-stream name.
      properties:
        eventId:
          description: Stable identifier for de-duplication across overlapping pages.
          type: string
        level:
          description: >-
            Classified level: `debug` | `info` | `warn` | `error`. Taken from
            the `level` structured-metadata label the addons collector attaches
            when present, and otherwise classified from the line by the same
            rules the CloudWatch path uses — so the two sources agree about what
            an error is.
          type: string
        logSourceId:
          description: >-
            ui.logs source id within that instance. Empty for rows matched
            through `deploymentResourceId`.
          type: string
        message:
          description: The log line as the workload printed it.
          type: string
        sourceId:
          description: >-
            Module instance the matched ui.logs source belongs to. Empty for
            rows matched through `deploymentResourceId`.
          type: string
        stream:
          description: >-
            Human-readable identity of the Loki stream the line came from,
            rendered from its labels (e.g. `production/api`). Fills the same
            column as CloudWatch's `logStream`.
          type: string
        timestamp:
          description: Line timestamp, epoch milliseconds.
          format: int64
          type: integer
      required:
        - timestamp
        - message
        - stream
        - sourceId
        - logSourceId
        - level
      type: object
  securitySchemes:
    BearerAuth:
      scheme: Bearer
      type: http

````