---
title: "Search logs"
method: POST
path: "/api/v1/logs-queries/list"
tags: ["Logs"]
---

# Search logs

`POST /api/v1/logs-queries/list`

List endpoint returns logs that match a log search query.
[Results are paginated][1].

**If you are considering archiving logs for your organization,
consider use of the Datadog archive capabilities instead of the log list API.
See [Datadog Logs Archive documentation][2].**

**Note**: This endpoint is enabled by default for logs customers. To disable it, contact [Datadog support](https://docs.datadoghq.com/help/).

[1]: /logs/guide/collect-multiple-logs-with-pagination
[2]: https://docs.datadoghq.com/logs/archives

## Request body

- LogsListRequest — Object to send with the request to retrieve a list of logs from your Organization.
  - `index` string — The log index on which the request is performed. For multi-index organizations, the default is all live indexes. Historical indexes of rehydrated logs must be specified.
  - `limit` integer — Number of logs return in the response.
  - `query` string — The search query - following the log search syntax.
  - `sort` 'asc' | 'desc' — Time-ascending `asc` or time-descending `desc` results.
  - `startAt` string — Hash identifier of the first log to return in the list, available in a log `id` attribute. This parameter is used for the pagination feature. **Note**: This parameter is ignored if the corresponding log is out of the scope of the specified time window.
  - `time` LogsListRequestTime, required — Timeframe to retrieve the log from.
    - `from` string, date-time, required — Minimum timestamp for requested logs.
    - `timezone` string — Timezone can be specified both as an offset (for example "UTC+03:00") or a regional zone (for example "Europe/Paris").
    - `to` string, date-time, required — Maximum timestamp for requested logs.

## Response `200`

OK

- LogsListResponse — Response object with all logs matching the request and pagination information.
  - `logs` Log[] — Array of logs matching the request and the `nextLogId` if sent.
    - `content` LogContent — JSON object containing all log attributes and their associated values.
      - `attributes` object — JSON object of attributes from your log.
      - `host` string — Name of the machine from where the logs are being sent.
      - `message` string — The message [reserved attribute](https://docs.datadoghq.com/logs/log_collection/#reserved-attributes) of your log. By default, Datadog ingests the value of the message attribute as the body of the log entry. That value is then highlighted and displayed in the Logstream, where it is indexed for full text search.
      - `service` string — The name of the application or service generating the log events. It is used to switch from Logs to APM, so make sure you define the same value when you use both products.
      - `tags` string[] — Array of tags associated with your log.
      - `timestamp` string, date-time — Timestamp of your log.
    - `id` string — ID of the Log.
  - `nextLogId` string, nullable — Hash identifier of the next log to return in the list. This parameter is used for the pagination feature.
  - `status` string — Status of the response.

## Other responses

- `400` — Bad Request
- `403` — Authentication error
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v1.md) · [All operations](https://skmtc.net/datadog/apis/api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v1/revisions/ca5871004d26/schema)