Logs

For instructions on how to authenticate to use this endpoint, see API overview.

Endpoints

GET
POST
GET
PATCH
DELETE
POST
POST
GET
POST
POST
GET
POST
POST
POST
POST
GET
POST
GET
POST
Next page →

List all environments logs alerts

Also available via the PostHog MCP server:

  • logs-alerts-list — List log alerts

Required API key scopes

logs:read

Query parameters

  • limit
    integer
  • offset
    integer

Response


Example request

GET /api/environments/:environment_id/logs/alerts
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/

Example response

Status 200
RESPONSE
{
  "count": 123,
  "next": "http://api.example.org/accounts/?offset=400&limit=100",
  "previous": "http://api.example.org/accounts/?offset=200&limit=100",
  "results": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "name": "string",
      "enabled": true,
      "filters": {
        "filterGroup": null,
        "serviceNames": null,
        "severityLevels": null
      },
      "threshold_count": 100,
      "threshold_operator": "above",
      "window_minutes": 5,
      "check_interval_minutes": 0,
      "state": "not_firing",
      "evaluation_periods": 1,
      "datapoints_to_alarm": 1,
      "cooldown_minutes": 0,
      "snooze_until": "2019-08-24T14:15:22Z",
      "next_check_at": "2019-08-24T14:15:22Z",
      "last_notified_at": "2019-08-24T14:15:22Z",
      "last_checked_at": "2019-08-24T14:15:22Z",
      "consecutive_failures": 0,
      "last_error_message": "string",
      "state_timeline": [
        {
          "start": "2019-08-24T14:15:22Z",
          "end": "2019-08-24T14:15:22Z",
          "state": "not_firing",
          "enabled": true
        }
      ],
      "destination_types": [
        "slack"
      ],
      "first_enabled_at": "2019-08-24T14:15:22Z",
      "created_at": "2019-08-24T14:15:22Z",
      "created_by": {
        "id": 0,
        "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
        "distinct_id": "string",
        "first_name": "string",
        "last_name": "string",
        "email": "user@example.com",
        "is_email_verified": true,
        "hedgehog_config": {},
        "role_at_organization": "engineering"
      },
      "updated_at": "2019-08-24T14:15:22Z"
    }
  ]
}

Create environments logs alerts

Also available via the PostHog MCP server:

  • logs-alerts-create — Create log alert

Required API key scopes

logs:write

Request parameters

  • name
    string
  • enabled
    boolean
    Default: true
  • filters
  • threshold_count
    integer
    Default: 100
  • threshold_operator
    Default: above
  • window_minutes
    integer
    Default: 5
  • evaluation_periods
    integer
    Default: 1
  • datapoints_to_alarm
    integer
    Default: 1
  • cooldown_minutes
    integer
    Default: 0
  • snooze_until
    stringnull

Response


Example request

POST /api/environments/:environment_id/logs/alerts
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/\
	-d name="string"

Example response

Status 201
RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": true,
  "filters": {
    "filterGroup": null,
    "serviceNames": null,
    "severityLevels": null
  },
  "threshold_count": 100,
  "threshold_operator": "above",
  "window_minutes": 5,
  "check_interval_minutes": 0,
  "state": "not_firing",
  "evaluation_periods": 1,
  "datapoints_to_alarm": 1,
  "cooldown_minutes": 0,
  "snooze_until": "2019-08-24T14:15:22Z",
  "next_check_at": "2019-08-24T14:15:22Z",
  "last_notified_at": "2019-08-24T14:15:22Z",
  "last_checked_at": "2019-08-24T14:15:22Z",
  "consecutive_failures": 0,
  "last_error_message": "string",
  "state_timeline": [
    {
      "start": "2019-08-24T14:15:22Z",
      "end": "2019-08-24T14:15:22Z",
      "state": "not_firing",
      "enabled": true
    }
  ],
  "destination_types": [
    "slack"
  ],
  "first_enabled_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": {
    "id": 0,
    "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
    "distinct_id": "string",
    "first_name": "string",
    "last_name": "string",
    "email": "user@example.com",
    "is_email_verified": true,
    "hedgehog_config": {},
    "role_at_organization": "engineering"
  },
  "updated_at": "2019-08-24T14:15:22Z"
}

Retrieve environments logs alerts

Also available via the PostHog MCP server:

  • logs-alerts-retrieve — Get log alert

Required API key scopes

logs:read

Path parameters

  • id
    string

Response


Example request

GET /api/environments/:environment_id/logs/alerts/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/

Example response

Status 200
RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": true,
  "filters": {
    "filterGroup": null,
    "serviceNames": null,
    "severityLevels": null
  },
  "threshold_count": 100,
  "threshold_operator": "above",
  "window_minutes": 5,
  "check_interval_minutes": 0,
  "state": "not_firing",
  "evaluation_periods": 1,
  "datapoints_to_alarm": 1,
  "cooldown_minutes": 0,
  "snooze_until": "2019-08-24T14:15:22Z",
  "next_check_at": "2019-08-24T14:15:22Z",
  "last_notified_at": "2019-08-24T14:15:22Z",
  "last_checked_at": "2019-08-24T14:15:22Z",
  "consecutive_failures": 0,
  "last_error_message": "string",
  "state_timeline": [
    {
      "start": "2019-08-24T14:15:22Z",
      "end": "2019-08-24T14:15:22Z",
      "state": "not_firing",
      "enabled": true
    }
  ],
  "destination_types": [
    "slack"
  ],
  "first_enabled_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": {
    "id": 0,
    "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
    "distinct_id": "string",
    "first_name": "string",
    "last_name": "string",
    "email": "user@example.com",
    "is_email_verified": true,
    "hedgehog_config": {},
    "role_at_organization": "engineering"
  },
  "updated_at": "2019-08-24T14:15:22Z"
}

Update environments logs alerts

Also available via the PostHog MCP server:

  • logs-alerts-partial-update — Update log alert

Required API key scopes

logs:write

Path parameters

  • id
    string

Request parameters

  • name
    string
  • enabled
    boolean
    Default: true
  • filters
  • threshold_count
    integer
    Default: 100
  • threshold_operator
    Default: above
  • window_minutes
    integer
    Default: 5
  • evaluation_periods
    integer
    Default: 1
  • datapoints_to_alarm
    integer
    Default: 1
  • cooldown_minutes
    integer
    Default: 0
  • snooze_until
    stringnull

Response


Example request

PATCH /api/environments/:environment_id/logs/alerts/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl -X PATCH \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/\
	-d name="string"

Example response

Status 200
RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": true,
  "filters": {
    "filterGroup": null,
    "serviceNames": null,
    "severityLevels": null
  },
  "threshold_count": 100,
  "threshold_operator": "above",
  "window_minutes": 5,
  "check_interval_minutes": 0,
  "state": "not_firing",
  "evaluation_periods": 1,
  "datapoints_to_alarm": 1,
  "cooldown_minutes": 0,
  "snooze_until": "2019-08-24T14:15:22Z",
  "next_check_at": "2019-08-24T14:15:22Z",
  "last_notified_at": "2019-08-24T14:15:22Z",
  "last_checked_at": "2019-08-24T14:15:22Z",
  "consecutive_failures": 0,
  "last_error_message": "string",
  "state_timeline": [
    {
      "start": "2019-08-24T14:15:22Z",
      "end": "2019-08-24T14:15:22Z",
      "state": "not_firing",
      "enabled": true
    }
  ],
  "destination_types": [
    "slack"
  ],
  "first_enabled_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": {
    "id": 0,
    "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
    "distinct_id": "string",
    "first_name": "string",
    "last_name": "string",
    "email": "user@example.com",
    "is_email_verified": true,
    "hedgehog_config": {},
    "role_at_organization": "engineering"
  },
  "updated_at": "2019-08-24T14:15:22Z"
}

Delete environments logs alerts

Also available via the PostHog MCP server:

  • logs-alerts-destroy — Delete log alert

Required API key scopes

logs:write

Path parameters

  • id
    string

Example request

DELETE /api/environments/:environment_id/logs/alerts/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl  -X DELETE \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/

Example response

Status 204 No response body

Create environments logs alerts destinations

Also available via the PostHog MCP server:

  • logs-alerts-destinations-create — Attach alert destination

Create a notification destination for this alert. One HogFunction is created per alert event kind (firing, resolved, ...) atomically.

Required API key scopes

logs:write

Path parameters

  • id
    string

Request parameters

  • type
  • slack_workspace_id
    integer
  • slack_channel_id
    string
  • slack_channel_name
    string
  • webhook_url
    string

Response


Example request

POST /api/environments/:environment_id/logs/alerts/:id/destinations
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/destinations/\
	-d type=undefined

Example response

Status 201
RESPONSE
{
  "hog_function_ids": [
    "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  ]
}

Create environments logs alerts destinations delete

Also available via the PostHog MCP server:

  • logs-alerts-destinations-delete-create — Detach alert destination

Delete a notification destination by deleting its HogFunction group atomically.

Required API key scopes

logs:write

Path parameters

  • id
    string

Request parameters

  • hog_function_ids
    array

Example request

POST /api/environments/:environment_id/logs/alerts/:id/destinations/delete
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/destinations/delete/\
	-d hog_function_ids="array"

Example response

Status 204 No response body

List all environments logs alerts events

Also available via the PostHog MCP server:

  • logs-alerts-events-list — List alert events

Paginated event history for this alert, newest first. Returns state transitions, errored checks, and user-initiated control-plane rows (reset, enable/disable, snooze/unsnooze, threshold change) — quiet no-op check rows (where state didn't change and there was no error) are filtered out since only the last 10 are kept and they carry no forensic value. Optional ?kind=... narrows to a single kind.

Required API key scopes

logs:read

Path parameters

  • id
    string

Query parameters

  • limit
    integer
  • offset
    integer

Response


Example request

GET /api/environments/:environment_id/logs/alerts/:id/events
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/events/

Example response

Status 200
RESPONSE
{
  "count": 123,
  "next": "http://api.example.org/accounts/?offset=400&limit=100",
  "previous": "http://api.example.org/accounts/?offset=200&limit=100",
  "results": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "created_at": "2019-08-24T14:15:22Z",
      "kind": "check",
      "state_before": "string",
      "state_after": "string",
      "threshold_breached": true,
      "result_count": 0,
      "error_message": "string",
      "query_duration_ms": 0
    }
  ]
}

Create environments logs alerts reset

Reset a broken alert. Clears the consecutive-failure counter and schedules an immediate recheck.

Required API key scopes

logs:write

Path parameters

  • id
    string

Response


Example request

POST /api/environments/:environment_id/logs/alerts/:id/reset
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/:id/reset/

Example response

Status 200
RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": true,
  "filters": {
    "filterGroup": null,
    "serviceNames": null,
    "severityLevels": null
  },
  "threshold_count": 100,
  "threshold_operator": "above",
  "window_minutes": 5,
  "check_interval_minutes": 0,
  "state": "not_firing",
  "evaluation_periods": 1,
  "datapoints_to_alarm": 1,
  "cooldown_minutes": 0,
  "snooze_until": "2019-08-24T14:15:22Z",
  "next_check_at": "2019-08-24T14:15:22Z",
  "last_notified_at": "2019-08-24T14:15:22Z",
  "last_checked_at": "2019-08-24T14:15:22Z",
  "consecutive_failures": 0,
  "last_error_message": "string",
  "state_timeline": [
    {
      "start": "2019-08-24T14:15:22Z",
      "end": "2019-08-24T14:15:22Z",
      "state": "not_firing",
      "enabled": true
    }
  ],
  "destination_types": [
    "slack"
  ],
  "first_enabled_at": "2019-08-24T14:15:22Z",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": {
    "id": 0,
    "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
    "distinct_id": "string",
    "first_name": "string",
    "last_name": "string",
    "email": "user@example.com",
    "is_email_verified": true,
    "hedgehog_config": {},
    "role_at_organization": "engineering"
  },
  "updated_at": "2019-08-24T14:15:22Z"
}

Create environments logs alerts simulate

Also available via the PostHog MCP server:

  • logs-alerts-simulate-create — Simulate log alert

Simulate a logs alert on historical data using the full state machine. Read-only — no alert check records are created.

Required API key scopes

logs:read

Request parameters

  • filters
  • threshold_count
    integer
  • threshold_operator
  • window_minutes
    integer
  • check_interval_minutes
    integer
    Default: 5
  • evaluation_periods
    integer
    Default: 1
  • datapoints_to_alarm
    integer
    Default: 1
  • cooldown_minutes
    integer
    Default: 0
  • date_from
    string

Response


Example request

POST /api/environments/:environment_id/logs/alerts/simulate
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/alerts/simulate/\
	-d filters=undefined,\
	-d threshold_count="integer",\
	-d threshold_operator=undefined,\
	-d window_minutes="integer",\
	-d date_from="string"

Example response

Status 200
RESPONSE
{
  "buckets": [
    {
      "timestamp": "2019-08-24T14:15:22Z",
      "count": 0,
      "threshold_breached": true,
      "state": "string",
      "notification": "string",
      "reason": "string"
    }
  ],
  "fire_count": 0,
  "resolve_count": 0,
  "total_buckets": 0,
  "threshold_count": 0,
  "threshold_operator": "string"
}

Retrieve environments logs attributes

Required API key scopes

logs:read

Query parameters

  • attribute_type
    string
    One of: "log""resource"
  • dateRange
  • filterGroup
    Click to open
    array
    Default:
  • limit
    integer
  • offset
    integer
  • search
    string
  • search_values
    boolean
    Default: false
  • serviceNames
    array
    Default:

Response


Example request

GET /api/environments/:environment_id/logs/attributes
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/attributes/

Example response

Status 200
RESPONSE
{
  "results": [
    {
      "name": "string",
      "propertyFilterType": "string",
      "matchedOn": "key",
      "matchedValue": "string"
    }
  ],
  "count": 0
}

Create environments logs count

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/environments/:environment_id/logs/count
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/count/\
	-d query=undefined

Example response

Status 200
RESPONSE
{
  "count": 0
}

Create environments logs count ranges

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/environments/:environment_id/logs/count-ranges
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/count-ranges/\
	-d query=undefined

Example response

Status 200
RESPONSE
{
  "ranges": [
    {
      "date_from": "string",
      "date_to": "string",
      "count": 0
    }
  ],
  "interval": "string"
}

Create environments logs explainlogwithai

Explain a log entry using AI.

POST /api/environments/:id/logs/explainLogWithAI/

Required API key scopes

logs:write

Request parameters

  • uuid
    string
  • timestamp
    string
  • force_refresh
    boolean
    Default: false

Response


Example request

POST /api/environments/:environment_id/logs/explainLogWithAI
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/explainLogWithAI/\
	-d uuid="string",\
	-d timestamp="string"

Example response

Status 201
RESPONSE
{
  "uuid": "string",
  "timestamp": "2019-08-24T14:15:22Z",
  "force_refresh": false
}

Create environments logs export

Required API key scopes

logs:read

Example request

POST /api/environments/:environment_id/logs/export
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/export/

Example response

Status 201

Retrieve environments logs has logs

Required API key scopes

logs:read

Example request

GET /api/environments/:environment_id/logs/has_logs
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/has_logs/

Example response

Status 200

Create environments logs query

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/environments/:environment_id/logs/query
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/query/\
	-d query=undefined

Example response

Status 200
RESPONSE
{
  "query": {},
  "results": [
    {
      "uuid": "string",
      "timestamp": "string",
      "observed_timestamp": "string",
      "body": "string",
      "severity_text": "string",
      "severity_number": 0,
      "level": "string",
      "trace_id": "string",
      "span_id": "string",
      "trace_flags": 0,
      "attributes": {
        "property1": "string",
        "property2": "string"
      },
      "resource_attributes": {
        "property1": "string",
        "property2": "string"
      },
      "event_name": "string"
    }
  ],
  "hasMore": true,
  "nextCursor": "string",
  "maxExportableLogs": 0
}

List all environments logs sampling rules

Required API key scopes

logs:read

Query parameters

  • limit
    integer
  • offset
    integer

Response


Example request

GET /api/environments/:environment_id/logs/sampling_rules
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/sampling_rules/

Example response

Status 200
RESPONSE
{
  "count": 123,
  "next": "http://api.example.org/accounts/?offset=400&limit=100",
  "previous": "http://api.example.org/accounts/?offset=200&limit=100",
  "results": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "name": "string",
      "enabled": false,
      "priority": 0,
      "rule_type": "severity_sampling",
      "scope_service": "string",
      "scope_path_pattern": "string",
      "scope_attribute_filters": [
        {}
      ],
      "config": null,
      "version": 0,
      "created_by": 0,
      "created_at": "2019-08-24T14:15:22Z",
      "updated_at": "2019-08-24T14:15:22Z"
    }
  ]
}

Create environments logs sampling rules

Required API key scopes

logs:write

Request parameters

  • name
    string
  • enabled
    boolean
    Default: false
  • priority
    integernull
  • rule_type
  • scope_service
    stringnull
  • scope_path_pattern
    stringnull
  • scope_attribute_filters
    array
  • config

Response


Example request

POST /api/environments/:environment_id/logs/sampling_rules
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/environments/:environment_id/logs/sampling_rules/\
	-d name="string",\
	-d rule_type=undefined,\
	-d config=undefined

Example response

Status 201
RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": false,
  "priority": 0,
  "rule_type": "severity_sampling",
  "scope_service": "string",
  "scope_path_pattern": "string",
  "scope_attribute_filters": [
    {}
  ],
  "config": null,
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}
Next page →

Community questions

Questions about this page? or post a community question.