> ## Documentation Index > Fetch the complete documentation index at: https://docs.orq.ai/llms.txt > Use this file to discover all available pages before exploring further. # Query logs with OQL > Run an OQL log query using the pipeline grammar `fetch logs | filter | sort timestamp desc | limit N`. The query is compiled onto the same engine as SearchLogs; timestamp desc is the only supported sort. ## OpenAPI ````yaml post /v3/logs/query openapi: 3.1.0 info: title: orq.ai API version: '2.0' description: orq.ai API documentation servers: - url: https://my.orq.ai security: - ApiKey: [] tags: - name: Chunking description: Split text into smaller chunks for retrieval and generation workflows. - name: File Systems description: >- Create and manage persistent file systems that agents and MCP clients read from and write to. - name: Knowledge Bases description: Create and manage knowledge bases used by agents and retrieval workflows. - name: Memory Stores description: Create and manage memory stores, memories, and memory documents. - name: Evals description: Run an evaluator against a conversation and its result - name: Logs description: >- OpenTelemetry log query API. Search, filter, aggregate, and facet log records ingested via OTLP. - name: Reporting description: >- GenAI reporting API over canonical analytics rollups. Accepts a metric name, time range, grain, group-by, and filters; returns a typed time series and optional totals. - name: Traces description: >- Query and inspect ingested trace data: search trace summaries, aggregate metrics, and read individual traces and their spans. - description: List models available through the AI Router. name: Models - name: Policies - name: Alerts description: >- Alerts evaluate a Reporting API metric on a fixed interval and fire notifications through notifiers when the value breaches a threshold. Each breach opens a trigger that tracks the incident until the value recovers. - name: Annotation Queues description: Annotation queues collect spans for human review. - name: API keys description: >- API keys authenticate programmatic access to the workspace. They expose opaque tokens, per-domain access grants, and budget and rate-limit constraints. - name: Audit Logs description: Audit logs record workspace entity changes and access-relevant events. - name: Budgets description: >- Budgets govern spend, token usage, and request rate across six scopes: workspace, project, identity, API key, provider, and model. Every applicable budget is enforced, and the most restrictive limit applies per dimension. - name: Files description: File upload and retrieval operations. - name: Guardrail Rules description: >- Guardrail Rules conditionally enforce evaluators and plugins for AI Gateway traffic. Rules may be scoped to a project or the whole workspace. - name: Hub description: Hub items are reusable templates available to a workspace. - name: Identities description: >- Identities represent end users from your system for usage and engagement tracking. - name: Management keys description: >- Management keys are workspace-scoped credentials that authenticate programmatic access to workspace administration surfaces (API keys, budgets). Unlike project-scoped API keys, a management key always operates at the workspace level. - name: MCP Gateway description: >- Register upstream MCP servers, discover and sync their tools, and assemble gateways that expose a curated tool surface to MCP clients. - name: Model Catalog description: >- Browse the orq.ai model catalog: every model orq offers, across every provider, with pricing, capabilities and benchmark data. List endpoints only return models that are not deprecated. This API is public, requires no authentication, and is rate limited to 120 requests per minute per IP. Responses carry a 5-minute cache-control max-age. - name: Notifiers description: Notifier destinations used to send delivery and workflow notifications. - name: Projects description: Projects organize resources within a workspace - name: Routing Rules description: >- Routing Rules conditionally select models and enforce request plugins for AI Gateway traffic. Rules are evaluated by ascending priority and may be scoped to a project or the whole workspace. - name: Threads description: Threads group related trace invocations and their aggregate usage - name: Skills description: >- Skills are modular instructions you can use to codify processes and conventions - name: Smart Routers description: >- Create and manage workspace Smart Routers. A Smart Router selects a model from an eligible pool for each request according to a quality, balanced, or cost profile. - name: Webhooks description: >- Create and manage webhooks that deliver workspace events to external HTTPS endpoints. - name: Workspaces description: >- A workspace is the tenant. Create is a user-session onboarding RPC; Get, List, and Update are the public management surface. - name: Workspace Security description: >- Workspace-level domain verification and IP allowlist controls. These operations are restricted to workspace administrators. - name: Workspace Settings description: >- Workspace-level settings managed with a workspace credential. A workspace is the tenant, so these settings are a singleton — there is nothing to create or delete, only read and update. - name: Responses - description: Run agents on a cron cadence. Minimum firing interval is 1 hour. name: Agent Schedules - name: Embeddings - name: Telemetry description: >- Unified query envelope for traces, metrics, and logs (ADR 0004). One request shape, one filter dialect, and one response shape per source, validated by a per-source registry. externalDocs: url: https://docs.orq.ai description: orq.ai Documentation paths: /v3/logs/query: post: tags: - Logs summary: Query logs with OQL description: >- Run an OQL log query using the pipeline grammar `fetch logs | filter | sort timestamp desc | limit N`. The query is compiled onto the same engine as SearchLogs; timestamp desc is the only supported sort. operationId: QueryLogs requestBody: content: application/json: schema: $ref: '#/components/schemas/QueryLogsRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/QueryLogsResponse' components: schemas: QueryLogsRequest: required: - from - to - oql type: object properties: oql: type: string description: |- OQL query string, e.g. `fetch logs | filter severity_number > 10 | filter body contains "error"`. limit: type: integer description: >- Maximum rows to return; a `| limit N` pipeline command takes precedence. format: int32 from: type: string format: date-time to: type: string format: date-time page_token: type: string description: Opaque cursor for pagination. QueryLogsResponse: type: object properties: object: type: string description: Object discriminator; always "query". Mirrors QueryTracesResponse. search: $ref: '#/components/schemas/SearchLogsResponse' SearchLogsResponse: type: object properties: object: type: string description: Object discriminator; always "list". Mirrors SearchTracesResponse. data: type: array items: $ref: '#/components/schemas/Log' has_more: type: boolean next_page_token: type: string description: Keyset cursor for the next page; empty when has_more is false. meta: $ref: '#/components/schemas/TraceSearchMeta' total_count: type: string description: >- Exact match count for the full time range (cursor-independent, constant across pages). int64 serializes as a JSON string per protojson. Log: type: object properties: id: type: string trace_id: type: string span_id: type: string timestamp: type: string format: date-time observed_timestamp: type: string format: date-time severity_number: type: integer format: int32 severity_text: type: string body: type: string body_is_json: type: boolean event_name: type: string dropped_attributes_count: type: integer format: int32 trace_flags: type: integer format: uint32 scope_name: type: string scope_version: type: string scope_attributes: type: object additionalProperties: type: string log_attributes: type: object additionalProperties: type: string resource_attributes: type: object additionalProperties: type: string service_name: type: string service_version: type: string deployment_environment: type: string host_name: type: string project_id: type: string description: Log is the canonical wire representation of an otel_logs row. TraceSearchMeta: type: object properties: request_id: type: string from: type: string format: date-time to: type: string format: date-time row_count: type: integer format: int32 securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: JWT ````