---
title: "Fetch logs with optional filtering"
method: GET
path: "/logs"
---

# Fetch logs with optional filtering

`GET /logs`

Fetch log lines newest-first, paging backwards towards the start of the file. When level or keyword is set the server keeps reading backwards until the requested number of *matching* lines has been collected, the start of the file is reached, or the per-request scan cap (32 MiB) is hit — so has_more means "more matches may exist", not merely "more bytes exist". Offsets in next_cursor are byte offsets into the file the page was read from; for a .log.gz archive they address the uncompressed stream.

## Query parameters

- `lines` string
- `level` string
- `keyword` string
- `cursor` string
- `file` string

## Response `200`

Logs fetched successfully

- Logs
  - `logs` string[] — Log lines for this page, newest first. Empty rather than null when nothing matched.
  - `log_file` string — Name of the log file the lines were read from.
  - `log_count` integer, required — Number of lines in this page — that is, the length of logs after filtering. Not a count of matches in the file.
  - `total_size` integer, required — Size in bytes of the whole log file, independent of this page and of any filter. For a .log.gz archive this is the uncompressed size, since offsets address the decompressed stream.
  - `has_more` boolean, required — Whether the backwards scan stopped before the start of the file, i.e. older lines remain to be searched. True implies next_cursor is set. Unfiltered this means more lines exist; filtered it means more matches may exist — the final page of a filtered search can legitimately come back empty.
  - `next_cursor` string — Opaque cursor for the next (older) page; present only when has_more is true.
  - `scanned_bytes` integer, required — Bytes examined to build this page. Equal to the page's own span when unfiltered; larger for a filtered query that had to search backwards past non-matching lines. Compare against total_size to show progress through a long search.

## Other responses

- `400` — Invalid query parameters
- `500` — Internal server error

---

[API](https://skmtc.net/loxilb-io/apis/loxilb-rest-api.md) · [All operations](https://skmtc.net/loxilb-io/apis/loxilb-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/loxilb-io/loxilb-rest-api/revisions/f9fcf4a184f6/schema)