---
title: "Aggregate logs"
method: POST
path: "/v3/logs/aggregate"
tags: ["Logs"]
---

# Aggregate logs

`POST /v3/logs/aggregate`

Return severity counts grouped by time buckets at a configurable grain (auto, minute, hour, day).

## Request body

- AggregateLogsRequest
  - `from` string, date-time
  - `to` string, date-time
  - `grain` string — Time bucket grain: "auto" | "minute" | "hour" | "day", matching the shared libs/go/reporting Grain vocabulary used by the traces reporting API. Empty defaults to "auto" (grain picked from the time range).
  - `filters` TraceFilter[]
    - `field` string
    - `op` string
    - `values` string[]

## Response `200`

OK

- AggregateLogsResponse
  - `object` string
  - `buckets` AggregateBucket[]
    - `timestamp` string, date-time
    - `severity_counts` object — severity_number → count
    - `total_count` string

---

[API](https://skmtc.net/orq-ai/apis/orq-ai-api.md) · [All operations](https://skmtc.net/orq-ai/apis/orq-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/orq-ai/orq-ai-api/versions/1072e5ba28ab/schema)