Query
Execute SPL2 query
Core search endpoint. Executes any SPL2 pipeline including search, aggregation, and management commands.
Execution modes (controlled by wait parameter):
| wait value | Behavior | Response |
|---|---|---|
| null (default) | Sync. Block up to query.sync_timeout (30s). | 200 with results, or 202 + job if it exceeds the timeout |
| 0 | Async. Return immediately. | 202 with job handle |
| N (seconds) | Hybrid. Wait up to N seconds. | 200 if done in time, 202 + job otherwise |
Hybrid mode (wait: 5) is ideal for Web UI — fast queries return instantly, slow ones degrade to async with progress tracking.
Response data.type determines rendering:
- events → log viewer (raw events)
- aggregate → table (stats results)
- timechart → chart (time-series)
- view_created → MV creation confirmation (when query contains | materialize)
- job → async job handle (when wait is set and query didn't complete in time)
MV acceleration: when the query planner detects a Materialized View that covers the query, meta.accelerated_by is present in the response.
SPL2 management commands also flow through this endpoint:
- | materialize "name" — create MV
- | from mv_name — read from MV
- | views — list MVs
- | dropview "name" — delete MV
post/query
Request body
Example request
{
"q": "source=nginx status>=500 | stats count by uri",
"from": "-1h",
"wait": 5
}Response
Query completed synchronously. Returned when:
- wait is null (default sync mode) and query completes in-request
- wait is N > 0 (hybrid mode) and query completes within N seconds
Example response
{
"data": {
"events": [
{
"message": "GET /api/users 200 12ms",
"level": "info",
"source": "nginx",
"status": 200
}
]
},
"meta": {
"accelerated_by": {
"speedup": "~400x"
}
}
}