Logs API Reference

Logs

For instructions on how to authenticate to use this endpoint, see API overview.

Endpoints

`POST`
`GET`
`PATCH`
`DELETE`
`POST`
`POST`
`POST`
`GET`
`POST`
`GET`
`PATCH`
`DELETE`
`POST`
`POST`
`POST`
`POST`
`GET`
`GET`

← Previous pageNext page →

Create logs metric rules

Required API key scopes

logs:writemetrics:write

Request parameters

name
string
metric_name
string
enabled
boolean
Default: false
filter_group
value_attribute
stringnull
group_by
array

Response

Example request

POST /api/projects/:project_id/logs/metric_rules
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/metric_rules/\
	-d name="string",\
	-d metric_name="string"
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/metric_rules/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={
		"name": "string",
		"metric_name": "string"
	}
).json()

Example response

Status 201

RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "metric_name": "string",
  "enabled": false,
  "filter_group": null,
  "value_attribute": "string",
  "group_by": [
    "string"
  ],
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}

Retrieve logs metric rules

Required API key scopes

logs:read

Path parameters

id
string

Response

Example request

GET /api/projects/:project_id/logs/metric_rules/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/metric_rules/:id/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.get(
    "<ph_app_host>/api/projects/{project_id}/logs/metric_rules/{logs-2_id}/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
).json()

Example response

Status 200

RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "metric_name": "string",
  "enabled": false,
  "filter_group": null,
  "value_attribute": "string",
  "group_by": [
    "string"
  ],
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}

Update logs metric rules

Required API key scopes

logs:writemetrics:write

Path parameters

id
string

Request parameters

name
string
metric_name
string
enabled
boolean
Default: false
filter_group
value_attribute
stringnull
group_by
array

Response

Example request

PATCH /api/projects/:project_id/logs/metric_rules/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl -X PATCH \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/metric_rules/:id/\
	-d name="string"
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.patch(
    "<ph_app_host>/api/projects/{project_id}/logs/metric_rules/{logs-2_id}/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={
		"name": "string"
	}
).json()

Example response

Status 200

RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "metric_name": "string",
  "enabled": false,
  "filter_group": null,
  "value_attribute": "string",
  "group_by": [
    "string"
  ],
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}

Delete logs metric rules

Required API key scopes

logs:writemetrics:write

Path parameters

id
string

Example request

DELETE /api/projects/:project_id/logs/metric_rules/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl  -X DELETE \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/metric_rules/:id/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.delete(
    "<ph_app_host>/api/projects/{project_id}/logs/metric_rules/{logs-2_id}/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
)

Example response

Status 204 No response body

Create logs patterns

Required API key scopes

logs:read

Request parameters

query

Response

Example request

POST /api/projects/:project_id/logs/patterns
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/patterns/\
	-d query=undefined
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/patterns/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={}
).json()

Example response

Status 200

RESPONSE
{
  "patterns": [
    {
      "pattern": "string",
      "count": 0,
      "estimated_count": 0,
      "volume_share_pct": 0.1,
      "error_count": 0,
      "estimated_error_count": 0,
      "first_seen": "string",
      "last_seen": "string",
      "examples": [
        {
          "body": "string",
          "severity_text": "string",
          "service_name": "string",
          "timestamp": "string"
        }
      ],
      "services": [
        "string"
      ],
      "sparkline": [
        0
      ],
      "severity_counts": {
        "property1": 0,
        "property2": 0
      },
      "match_regex": "string",
      "match_literal": "string"
    }
  ],
  "scanned_count": 0,
  "total_count": 0,
  "sampled": true,
  "sample_coverage_pct": 0.1,
  "sparkline_buckets": [
    {
      "start": "string",
      "end": "string"
    }
  ]
}

Create logs patterns diff

Required API key scopes

logs:read

Request parameters

query
baselineDateRange

Response

Example request

POST /api/projects/:project_id/logs/patterns_diff
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/patterns_diff/\
	-d query=undefined
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/patterns_diff/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={}
).json()

Example response

Status 200

RESPONSE
{
  "entries": [
    {
      "classification": "new",
      "rate_ratio": 0,
      "pattern": {
        "pattern": "string",
        "count": 0,
        "estimated_count": 0,
        "volume_share_pct": 0.1,
        "error_count": 0,
        "estimated_error_count": 0,
        "first_seen": "string",
        "last_seen": "string",
        "examples": [
          {
            "body": "string",
            "severity_text": "string",
            "service_name": "string",
            "timestamp": "string"
          }
        ],
        "services": [
          "string"
        ],
        "sparkline": [
          0
        ],
        "severity_counts": {
          "property1": 0,
          "property2": 0
        },
        "match_regex": "string",
        "match_literal": "string"
      },
      "baseline_estimated_count": 0,
      "baseline_volume_share_pct": 0
    }
  ],
  "current": {
    "scanned_count": 0,
    "total_count": 0,
    "sampled": true,
    "sample_coverage_pct": 0.1,
    "date_from": "string",
    "date_to": "string"
  },
  "baseline": {
    "scanned_count": 0,
    "total_count": 0,
    "sampled": true,
    "sample_coverage_pct": 0.1,
    "date_from": "string",
    "date_to": "string"
  }
}

Create logs query

Required API key scopes

logs:read

Request parameters

query

Response

Example request

POST /api/projects/:project_id/logs/query
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/query/\
	-d query=undefined
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/query/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={}
).json()

Example response

Status 200

RESPONSE
{
  "query": {},
  "results": [
    {
      "uuid": "string",
      "timestamp": "string",
      "observed_timestamp": "string",
      "body": "string",
      "severity_text": "string",
      "severity_number": 0,
      "level": "string",
      "trace_id": "string",
      "span_id": "string",
      "trace_flags": 0,
      "attributes": {
        "property1": "string",
        "property2": "string"
      },
      "resource_attributes": {
        "property1": "string",
        "property2": "string"
      },
      "event_name": "string"
    }
  ],
  "hasMore": true,
  "nextCursor": "string",
  "maxExportableLogs": 0,
  "columns": [
    "string"
  ]
}

List all logs sampling rules

Required API key scopes

logs:read

Query parameters

limit
integer
offset
integer

Response

Example request

GET /api/projects/:project_id/logs/sampling_rules
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.get(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
).json()

Example response

Status 200

RESPONSE
{
  "count": 123,
  "next": "http://api.example.org/accounts/?offset=400&limit=100",
  "previous": "http://api.example.org/accounts/?offset=200&limit=100",
  "results": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "name": "string",
      "enabled": false,
      "priority": 0,
      "rule_type": "severity_sampling",
      "scope_service": "string",
      "scope_path_pattern": "string",
      "scope_attribute_filters": [
        {}
      ],
      "config": null,
      "version": 0,
      "created_by": 0,
      "created_at": "2019-08-24T14:15:22Z",
      "updated_at": "2019-08-24T14:15:22Z"
    }
  ]
}

Create logs sampling rules

Required API key scopes

logs:write

Request parameters

name
string
enabled
boolean
Default: false
priority
integernull
rule_type
scope_service
stringnull
scope_path_pattern
stringnull
scope_attribute_filters
array
config

Response

Example request

POST /api/projects/:project_id/logs/sampling_rules
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/\
	-d name="string",\
	-d rule_type=undefined,\
	-d config=undefined
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={
		"name": "string"
	}
).json()

Example response

Status 201

RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": false,
  "priority": 0,
  "rule_type": "severity_sampling",
  "scope_service": "string",
  "scope_path_pattern": "string",
  "scope_attribute_filters": [
    {}
  ],
  "config": null,
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}

Retrieve logs sampling rules

Required API key scopes

logs:read

Path parameters

id
string

Response

Example request

GET /api/projects/:project_id/logs/sampling_rules/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/:id/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.get(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/{logs-2_id}/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
).json()

Example response

Status 200

RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": false,
  "priority": 0,
  "rule_type": "severity_sampling",
  "scope_service": "string",
  "scope_path_pattern": "string",
  "scope_attribute_filters": [
    {}
  ],
  "config": null,
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}

Update logs sampling rules

Required API key scopes

logs:write

Path parameters

id
string

Request parameters

name
string
enabled
boolean
Default: false
priority
integernull
rule_type
scope_service
stringnull
scope_path_pattern
stringnull
scope_attribute_filters
array
config

Response

Example request

PATCH /api/projects/:project_id/logs/sampling_rules/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl -X PATCH \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/:id/\
	-d name="string"
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.patch(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/{logs-2_id}/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={
		"name": "string"
	}
).json()

Example response

Status 200

RESPONSE
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "enabled": false,
  "priority": 0,
  "rule_type": "severity_sampling",
  "scope_service": "string",
  "scope_path_pattern": "string",
  "scope_attribute_filters": [
    {}
  ],
  "config": null,
  "version": 0,
  "created_by": 0,
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z"
}

Delete logs sampling rules

Required API key scopes

logs:write

Path parameters

id
string

Example request

DELETE /api/projects/:project_id/logs/sampling_rules/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl  -X DELETE \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/:id/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.delete(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/{logs-2_id}/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
)

Example response

Status 204 No response body

Create logs sampling rules simulate

Dry-run estimate for how much volume this rule would remove (placeholder response until CH-backed simulation is wired).

Path parameters

id
string

Response

Example request

POST /api/projects/:project_id/logs/sampling_rules/:id/simulate
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/:id/simulate/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/{logs-2_id}/simulate/".format(
        project_id=project_id,
		logs-2_id="<the logs-2 id>"
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
).json()

Example response

Status 200

RESPONSE
{
  "estimated_reduction_pct": 0.1,
  "notes": "string"
}

Create logs sampling rules reorder

Atomically reassign priorities so the given ID order maps to ascending priorities (0..n-1).

Query parameters

limit
integer
offset
integer

Request parameters

ordered_ids
array

Response

Example request

POST /api/projects/:project_id/logs/sampling_rules/reorder
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sampling_rules/reorder/\
	-d ordered_ids="array"
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/sampling_rules/reorder/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={
		"ordered_ids": "array"
	}
).json()

Example response

Status 200

RESPONSE
{
  "count": 123,
  "next": "http://api.example.org/accounts/?offset=400&limit=100",
  "previous": "http://api.example.org/accounts/?offset=200&limit=100",
  "results": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "name": "string",
      "enabled": false,
      "priority": 0,
      "rule_type": "severity_sampling",
      "scope_service": "string",
      "scope_path_pattern": "string",
      "scope_attribute_filters": [
        {}
      ],
      "config": null,
      "version": 0,
      "created_by": 0,
      "created_at": "2019-08-24T14:15:22Z",
      "updated_at": "2019-08-24T14:15:22Z"
    }
  ]
}

Create logs services

Also available via the PostHog MCP server:
logs-services-create — List services with stats

Required API key scopes

logs:read

Request parameters

query

Response

Example request

POST /api/projects/:project_id/logs/services
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/services/\
	-d query=undefined
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/services/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={}
).json()

Example response

Status 200

RESPONSE
{
  "services": [
    {
      "service_name": "string",
      "log_count": 0,
      "error_count": 0,
      "error_rate": 0.1,
      "volume_share_pct": 0.1,
      "severity_breakdown": {
        "debug": 0,
        "info": 0,
        "warn": 0,
        "error": 0
      },
      "active_rules": [
        {
          "rule_id": "728c1541-d6d1-4290-9a53-cdf01dd32d60",
          "rule_name": "string",
          "summary_string": "string"
        }
      ]
    }
  ],
  "sparkline": [
    {
      "time": "string",
      "service_name": "string",
      "count": 0
    }
  ],
  "summary": {
    "top_services_count": 0,
    "top_services_volume_share_pct": 0.1
  }
}

Create logs sparkline

Required API key scopes

logs:read

Request parameters

query

Response

Example request

POST /api/projects/:project_id/logs/sparkline
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/sparkline/\
	-d query=undefined
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.post(
    "<ph_app_host>/api/projects/{project_id}/logs/sparkline/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
	data={}
).json()

Example response

Status 200

RESPONSE
{
  "results": [
    {
      "time": "string",
      "severity": "string",
      "service": "string",
      "count": 0,
      "bytes_uncompressed": 0
    }
  ]
}

Retrieve logs values

Required API key scopes

logs:read

Query parameters

attribute_type
string
One of: "log""resource"
dateRange
filterGroup
array
Default:
key
string
serviceNames
array
Default:
value
string

Response

Example request

GET /api/projects/:project_id/logs/values
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/values/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.get(
    "<ph_app_host>/api/projects/{project_id}/logs/values/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
).json()

Example response

Status 200

RESPONSE
{
  "results": [
    {
      "id": "string",
      "name": "string",
      "count": 0
    }
  ],
  "refreshing": true
}

List all logs views

Required API key scopes

logs:read

Query parameters

limit
integer
offset
integer

Response

Example request

GET /api/projects/:project_id/logs/views
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/projects/:project_id/logs/views/
api_key = "[your personal api key]"
project_id = "[your project id]"
response = requests.get(
    "<ph_app_host>/api/projects/{project_id}/logs/views/".format(
        project_id=project_id
    ),
    headers={"Authorization": "Bearer {}".format(api_key)},
).json()

Example response

Status 200

RESPONSE
{
  "count": 123,
  "next": "http://api.example.org/accounts/?offset=400&limit=100",
  "previous": "http://api.example.org/accounts/?offset=200&limit=100",
  "results": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "short_id": "string",
      "name": "string",
      "filters": {},
      "columns": [
        {
          "id": "string",
          "type": "timestamp",
          "name": "string",
          "expression": "string",
          "width": 1
        }
      ],
      "pinned": true,
      "created_at": "2019-08-24T14:15:22Z",
      "created_by": {
        "id": 0,
        "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
        "distinct_id": "string",
        "first_name": "string",
        "last_name": "string",
        "email": "user@example.com",
        "is_email_verified": true,
        "hedgehog_config": {},
        "role_at_organization": "engineering"
      },
      "updated_at": "2019-08-24T14:15:22Z"
    }
  ]
}

← Previous pageNext page →