---
title: "Search logs (GET)"
method: GET
path: "/api/v2/logs/events"
tags: ["Logs"]
---

# Search logs (GET)

`GET /api/v2/logs/events`

List endpoint returns logs that match a log search query.
[Results are paginated][1].

Use this endpoint to search and filter your logs.

**If you are considering archiving logs for your organization,
consider use of the Datadog archive capabilities instead of the log list API.
See [Datadog Logs Archive documentation][2].**

[1]: /logs/guide/collect-multiple-logs-with-pagination
[2]: https://docs.datadoghq.com/logs/archives

## Query parameters

- `filter[query]` string
- `filter[indexes]` string[]
- `filter[from]` string, date-time
- `filter[to]` string, date-time
- `filter[storage_tier]` 'indexes' | 'online-archives' | 'flex' — Specifies storage type as indexes, online-archives or flex
- `sort` 'timestamp' | '-timestamp' — Sort parameters when querying logs.
- `page[cursor]` string
- `page[limit]` integer

## Response `200`

OK

- LogsListResponse — Response object with all logs matching the request and pagination information.
  - `data` Log[] — Array of logs matching the request.
    - `attributes` LogAttributes — JSON object containing all log attributes and their associated values.
      - `attributes` object — JSON object of attributes from your log.
      - `host` string — Name of the machine from where the logs are being sent.
      - `message` string — The message [reserved attribute](https://docs.datadoghq.com/logs/log_collection/#reserved-attributes) of your log. By default, Datadog ingests the value of the message attribute as the body of the log entry. That value is then highlighted and displayed in the Logstream, where it is indexed for full text search.
      - `service` string — The name of the application or service generating the log events. It is used to switch from Logs to APM, so make sure you define the same value when you use both products.
      - `status` string — Status of the message associated with your log.
      - `tags` string[] — Array of tags associated with your log.
      - `timestamp` string, date-time — Timestamp of your log.
    - `id` string — Unique ID of the Log.
    - `type` 'log' — Type of the event.
  - `links` LogsListResponseLinks — Links attributes.
    - `next` string — Link for the next set of results. Note that the request can also be made using the POST endpoint.
  - `meta` LogsResponseMetadata — The metadata associated with a request
    - `elapsed` integer — The time elapsed in milliseconds
    - `page` LogsResponseMetadataPage — Paging attributes.
      - `after` string — The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.
    - `request_id` string — The identifier of the request
    - `status` 'done' | 'timeout' — The status of the response
    - `warnings` LogsWarning[] — A list of warnings (non fatal errors) encountered, partial results might be returned if warnings are present in the response.
      - `code` string — A unique code for this type of warning
      - `detail` string — A detailed explanation of this specific warning
      - `title` string — A short human-readable summary of the warning

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)