v1

latestOpenAPI 3.0.3Apache 2.02026-07-17333686.7 KB
Query

Execute query with NDJSON streaming

Returns an NDJSON stream for large result sets, exports, and piping.

This is different from job SSE (GET /query/jobs/{id}/stream):

  • /query/stream — NDJSON export of results. One event per line. For curl | jq, data pipelines.

  • /query/jobs/{id}/stream — SSE progress tracking. For Web UI real-time updates.

  • Response: Transfer-Encoding: chunked, one JSON object per line.

  • Last line is always {"__meta": {...}} — stream summary.

  • Supported request fields: q/query, from/earliest, to/latest, and variables.

  • limit, offset, wait, profile, and format are rejected with 400.

  • Client disconnect = cancellation.

post/query/stream

Request body

qstring

SPL2 query string

querystring

Alias for q

earlieststring

Legacy alias for from

lateststring

Legacy alias for to

fromstring

Start time: relative (-1h, -7d) or ISO 8601.

tostring

End time: relative (now, -5m) or ISO 8601.

variablesobject

Template variables substituted into the query before planning.

Response

NDJSON event stream