---
title: "Query logs with OQL"
method: POST
path: "/v3/logs/query"
tags: ["Logs"]
---

# Query logs with OQL

`POST /v3/logs/query`

Run an OQL log query using the pipeline grammar `fetch logs | filter <expr> | sort timestamp desc | limit N`. The query is compiled onto the same engine as SearchLogs; timestamp desc is the only supported sort.

## Request body

- QueryLogsRequest
  - `oql` string, required — OQL query string, e.g. `fetch logs | filter severity_number > 10 | filter body contains "error"`.
  - `limit` integer — Maximum rows to return; a `| limit N` pipeline command takes precedence.
  - `from` string, date-time, required
  - `to` string, date-time, required
  - `page_token` string — Opaque cursor for pagination.

## Response `200`

OK

- QueryLogsResponse
  - `object` string — Object discriminator; always "query". Mirrors QueryTracesResponse.
  - `search` SearchLogsResponse
    - `object` string — Object discriminator; always "list". Mirrors SearchTracesResponse.
    - `data` Log[]
      - `id` string
      - `trace_id` string
      - `span_id` string
      - `timestamp` string, date-time
      - `observed_timestamp` string, date-time
      - `severity_number` integer
      - `severity_text` string
      - `body` string
      - `body_is_json` boolean
      - `event_name` string
      - `dropped_attributes_count` integer
      - `trace_flags` integer
      - `scope_name` string
      - `scope_version` string
      - `scope_attributes` object
      - `log_attributes` object
      - `resource_attributes` object
      - `service_name` string
      - `service_version` string
      - `deployment_environment` string
      - `host_name` string
      - `project_id` string
    - `has_more` boolean
    - `next_page_token` string — Keyset cursor for the next page; empty when has_more is false.
    - `meta` TraceSearchMeta
      - `request_id` string
      - `from` string, date-time
      - `to` string, date-time
      - `row_count` integer
    - `total_count` string — Exact match count for the full time range (cursor-independent, constant across pages). int64 serializes as a JSON string per protojson.

---

[API](https://skmtc.net/orq-ai/apis/orq-ai-api.md) · [All operations](https://skmtc.net/orq-ai/apis/orq-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/orq-ai/orq-ai-api/versions/6a22c53a2580/schema)