Logs-5

For instructions on how to authenticate to use this endpoint, see API overview.

Endpoints

DELETE
POST
POST
GET
POST
POST
GET
POST
POST
POST
GET

Delete logs alerts

Also available via the PostHog MCP server:

  • logs-alerts-destroyDelete log alert

Required API key scopes

logs:write

Path parameters

  • id
    string

Example request

DELETE /api/projects/:project_id/logs/alerts/:id
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl -X DELETE \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/

Example response

Status 204 No response body

Create logs alerts destinations

Also available via the PostHog MCP server:

  • logs-alerts-destinations-createAttach alert destination

Create a notification destination for this alert. One HogFunction is created per alert event kind (firing, resolved, ...) atomically.

Path parameters

  • id
    string

Request parameters

  • type
  • slack_workspace_id
    integer
  • slack_channel_id
    string
  • slack_channel_name
    string
  • webhook_url
    string

Response


Example request

POST /api/projects/:project_id/logs/alerts/:id/destinations
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/destinations/\
-d type=undefined

Example response

Status 201
RESPONSE
{
"hog_function_ids": [
"497f6eca-6276-4993-bfeb-53cbbbba6f08"
]
}

Create logs alerts destinations

Also available via the PostHog MCP server:

  • logs-alerts-destinations-createAttach alert destination

Create a notification destination for this alert. One HogFunction is created per alert event kind (firing, resolved, ...) atomically.

Path parameters

  • id
    string

Request parameters

  • type
  • slack_workspace_id
    integer
  • slack_channel_id
    string
  • slack_channel_name
    string
  • webhook_url
    string

Response


Example request

POST /api/projects/:project_id/logs/alerts/:id/destinations
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/destinations/\
-d type=undefined

Example response

Status 201
RESPONSE
{
"hog_function_ids": [
"497f6eca-6276-4993-bfeb-53cbbbba6f08"
]
}

Create logs alerts destinations delete

Also available via the PostHog MCP server:

  • logs-alerts-destinations-delete-createDetach alert destination

Delete a notification destination by deleting its HogFunction group atomically.

Path parameters

  • id
    string

Request parameters

  • hog_function_ids
    array

Example request

POST /api/projects/:project_id/logs/alerts/:id/destinations/delete
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/destinations/delete/\
-d hog_function_ids="array"

Example response

Status 204 No response body

Create logs alerts destinations delete

Also available via the PostHog MCP server:

  • logs-alerts-destinations-delete-createDetach alert destination

Delete a notification destination by deleting its HogFunction group atomically.

Path parameters

  • id
    string

Request parameters

  • hog_function_ids
    array

Example request

POST /api/projects/:project_id/logs/alerts/:id/destinations/delete
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/destinations/delete/\
-d hog_function_ids="array"

Example response

Status 204 No response body

List all logs alerts events

Also available via the PostHog MCP server:

  • logs-alerts-events-listList alert events

Paginated event history for this alert, newest first. Returns state transitions, errored checks, and user-initiated control-plane rows (reset, enable/disable, snooze/unsnooze, threshold change) — quiet no-op check rows (where state didn't change and there was no error) are filtered out since only the last 10 are kept and they carry no forensic value. Optional ?kind=... narrows to a single kind.

Path parameters

  • id
    string

Query parameters

  • limit
    integer
  • offset
    integer

Response


Example request

GET /api/projects/:project_id/logs/alerts/:id/events
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/events/

Example response

Status 200
RESPONSE
{
"count": 123,
"next": "http://api.example.org/accounts/?offset=400&limit=100",
"previous": "http://api.example.org/accounts/?offset=200&limit=100",
"results": [
{
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"created_at": "2019-08-24T14:15:22Z",
"kind": "check",
"state_before": "string",
"state_after": "string",
"threshold_breached": true,
"result_count": 0,
"error_message": "string",
"query_duration_ms": 0
}
]
}

List all logs alerts events

Also available via the PostHog MCP server:

  • logs-alerts-events-listList alert events

Paginated event history for this alert, newest first. Returns state transitions, errored checks, and user-initiated control-plane rows (reset, enable/disable, snooze/unsnooze, threshold change) — quiet no-op check rows (where state didn't change and there was no error) are filtered out since only the last 10 are kept and they carry no forensic value. Optional ?kind=... narrows to a single kind.

Path parameters

  • id
    string

Query parameters

  • limit
    integer
  • offset
    integer

Response


Example request

GET /api/projects/:project_id/logs/alerts/:id/events
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/events/

Example response

Status 200
RESPONSE
{
"count": 123,
"next": "http://api.example.org/accounts/?offset=400&limit=100",
"previous": "http://api.example.org/accounts/?offset=200&limit=100",
"results": [
{
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"created_at": "2019-08-24T14:15:22Z",
"kind": "check",
"state_before": "string",
"state_after": "string",
"threshold_breached": true,
"result_count": 0,
"error_message": "string",
"query_duration_ms": 0
}
]
}

Create logs alerts reset

Reset a broken alert. Clears the consecutive-failure counter and schedules an immediate recheck.

Path parameters

  • id
    string

Response


Example request

POST /api/projects/:project_id/logs/alerts/:id/reset
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/reset/

Example response

Status 200
RESPONSE
{
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"name": "string",
"enabled": true,
"filters": {
"filterGroup": null,
"serviceNames": null,
"severityLevels": null
},
"threshold_count": 100,
"threshold_operator": "above",
"window_minutes": 5,
"check_interval_minutes": 0,
"state": "not_firing",
"evaluation_periods": 1,
"datapoints_to_alarm": 1,
"cooldown_minutes": 0,
"snooze_until": "2019-08-24T14:15:22Z",
"next_check_at": "2019-08-24T14:15:22Z",
"last_notified_at": "2019-08-24T14:15:22Z",
"last_checked_at": "2019-08-24T14:15:22Z",
"consecutive_failures": 0,
"last_error_message": "string",
"state_timeline": [
{
"start": "2019-08-24T14:15:22Z",
"end": "2019-08-24T14:15:22Z",
"state": "not_firing",
"enabled": true
}
],
"destination_types": [
"slack"
],
"first_enabled_at": "2019-08-24T14:15:22Z",
"created_at": "2019-08-24T14:15:22Z",
"created_by": {
"id": 0,
"uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
"distinct_id": "string",
"first_name": "string",
"last_name": "string",
"email": "user@example.com",
"is_email_verified": true,
"hedgehog_config": {},
"role_at_organization": "engineering"
},
"updated_at": "2019-08-24T14:15:22Z"
}

Create logs alerts reset

Reset a broken alert. Clears the consecutive-failure counter and schedules an immediate recheck.

Path parameters

  • id
    string

Response


Example request

POST /api/projects/:project_id/logs/alerts/:id/reset
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/:id/reset/

Example response

Status 200
RESPONSE
{
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"name": "string",
"enabled": true,
"filters": {
"filterGroup": null,
"serviceNames": null,
"severityLevels": null
},
"threshold_count": 100,
"threshold_operator": "above",
"window_minutes": 5,
"check_interval_minutes": 0,
"state": "not_firing",
"evaluation_periods": 1,
"datapoints_to_alarm": 1,
"cooldown_minutes": 0,
"snooze_until": "2019-08-24T14:15:22Z",
"next_check_at": "2019-08-24T14:15:22Z",
"last_notified_at": "2019-08-24T14:15:22Z",
"last_checked_at": "2019-08-24T14:15:22Z",
"consecutive_failures": 0,
"last_error_message": "string",
"state_timeline": [
{
"start": "2019-08-24T14:15:22Z",
"end": "2019-08-24T14:15:22Z",
"state": "not_firing",
"enabled": true
}
],
"destination_types": [
"slack"
],
"first_enabled_at": "2019-08-24T14:15:22Z",
"created_at": "2019-08-24T14:15:22Z",
"created_by": {
"id": 0,
"uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
"distinct_id": "string",
"first_name": "string",
"last_name": "string",
"email": "user@example.com",
"is_email_verified": true,
"hedgehog_config": {},
"role_at_organization": "engineering"
},
"updated_at": "2019-08-24T14:15:22Z"
}

Create logs alerts simulate

Also available via the PostHog MCP server:

  • logs-alerts-simulate-createSimulate log alert

Simulate a logs alert on historical data using the full state machine. Read-only — no alert check records are created.

Request parameters

  • filters
  • threshold_count
    integer
  • threshold_operator
  • window_minutes
    integer
  • check_interval_minutes
    integer
    Default: 5
  • evaluation_periods
    integer
    Default: 1
  • datapoints_to_alarm
    integer
    Default: 1
  • cooldown_minutes
    integer
    Default: 0
  • date_from
    string

Response


Example request

POST /api/projects/:project_id/logs/alerts/simulate
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/simulate/\
-d filters=undefined,\
-d threshold_count="integer",\
-d threshold_operator=undefined,\
-d window_minutes="integer",\
-d date_from="string"

Example response

Status 200
RESPONSE
{
"buckets": [
{
"timestamp": "2019-08-24T14:15:22Z",
"count": 0,
"threshold_breached": true,
"state": "string",
"notification": "string",
"reason": "string"
}
],
"fire_count": 0,
"resolve_count": 0,
"total_buckets": 0,
"threshold_count": 0,
"threshold_operator": "string"
}

Create logs alerts simulate

Also available via the PostHog MCP server:

  • logs-alerts-simulate-createSimulate log alert

Simulate a logs alert on historical data using the full state machine. Read-only — no alert check records are created.

Request parameters

  • filters
  • threshold_count
    integer
  • threshold_operator
  • window_minutes
    integer
  • check_interval_minutes
    integer
    Default: 5
  • evaluation_periods
    integer
    Default: 1
  • datapoints_to_alarm
    integer
    Default: 1
  • cooldown_minutes
    integer
    Default: 0
  • date_from
    string

Response


Example request

POST /api/projects/:project_id/logs/alerts/simulate
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/alerts/simulate/\
-d filters=undefined,\
-d threshold_count="integer",\
-d threshold_operator=undefined,\
-d window_minutes="integer",\
-d date_from="string"

Example response

Status 200
RESPONSE
{
"buckets": [
{
"timestamp": "2019-08-24T14:15:22Z",
"count": 0,
"threshold_breached": true,
"state": "string",
"notification": "string",
"reason": "string"
}
],
"fire_count": 0,
"resolve_count": 0,
"total_buckets": 0,
"threshold_count": 0,
"threshold_operator": "string"
}

Retrieve logs attributes

Required API key scopes

logs:read

Query parameters

  • attribute_type
    string
    One of: "log""resource"
  • dateRange
  • filterGroup
    Click to open
    array
    Default:
  • limit
    integer
  • offset
    integer
  • search
    string
  • search_values
    boolean
    Default: false
  • serviceNames
    array
    Default:

Response


Example request

GET /api/projects/:project_id/logs/attributes
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/attributes/

Example response

Status 200
RESPONSE
{
"results": [
{
"name": "string",
"propertyFilterType": "string",
"matchedOn": "key",
"matchedValue": "string"
}
],
"count": 0
}

Retrieve logs attributes

Required API key scopes

logs:read

Query parameters

  • attribute_type
    string
    One of: "log""resource"
  • dateRange
  • filterGroup
    Click to open
    array
    Default:
  • limit
    integer
  • offset
    integer
  • search
    string
  • search_values
    boolean
    Default: false
  • serviceNames
    array
    Default:

Response


Example request

GET /api/projects/:project_id/logs/attributes
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/attributes/

Example response

Status 200
RESPONSE
{
"results": [
{
"name": "string",
"propertyFilterType": "string",
"matchedOn": "key",
"matchedValue": "string"
}
],
"count": 0
}

Create logs count

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/projects/:project_id/logs/count
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/count/\
-d query=undefined

Example response

Status 200
RESPONSE
{
"count": 0
}

Create logs count

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/projects/:project_id/logs/count
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/count/\
-d query=undefined

Example response

Status 200
RESPONSE
{
"count": 0
}

Create logs count ranges

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/projects/:project_id/logs/count-ranges
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/count-ranges/\
-d query=undefined

Example response

Status 200
RESPONSE
{
"ranges": [
{
"date_from": "string",
"date_to": "string",
"count": 0
}
],
"interval": "string"
}

Create logs count ranges

Required API key scopes

logs:read

Request parameters

  • query

Response


Example request

POST /api/projects/:project_id/logs/count-ranges
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/count-ranges/\
-d query=undefined

Example response

Status 200
RESPONSE
{
"ranges": [
{
"date_from": "string",
"date_to": "string",
"count": 0
}
],
"interval": "string"
}

Create logs export

Required API key scopes

logs:read

Example request

POST /api/projects/:project_id/logs/export
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/export/

Example response

Status 201

Create logs export

Required API key scopes

logs:read

Example request

POST /api/projects/:project_id/logs/export
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl
-H 'Content-Type: application/json'\
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/export/

Example response

Status 201

Retrieve logs has logs

Required API key scopes

logs:read

Example request

GET /api/projects/:project_id/logs/has_logs
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
<ph_app_host>/api/projects/:project_id/logs/has_logs/

Example response

Status 200

Community questions

Questions about this page? or post a community question.