Logs
Aggregate Logs
Return severity counts grouped by time buckets at a configurable grain (auto, minute, hour, day).from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.aggregate()
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.aggregate({});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"from_": date, # optional
"to": date, # optional
"grain": Optional[str],
"filters": [{ # optional
"field": Optional[str],
"op": Optional[str],
"values": List[str], # optional
}],
}
{
from?: Date;
to?: Date;
grain?: string;
filters?: {
field?: string;
op?: string;
values?: string[];
}[];
}
Show Response
Show Response
{
"object": Optional[str],
"buckets": [{ # optional
"timestamp": date, # optional
"severity_counts": Dict[str, str], # optional
"total_count": Optional[str],
}],
}
{
object?: string;
buckets?: {
timestamp?: Date;
severityCounts?: Record<string, string>;
totalCount?: string;
}[];
}
List Facets
Return the facet hierarchy: attribute families (native, attribute, resource, scope) with their keys, counts, and top values for the requested time range.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.list_facets()
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.listFacets();
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"from_": date, # optional
"to": date, # optional
"key_limit": Optional[int],
"value_limit": Optional[int],
}
{
from?: Date;
to?: Date;
keyLimit?: number;
valueLimit?: number;
}
Show Response
Show Response
{
"groups": [{ # optional
"name": Optional[str],
"keys": [{ # optional
"key": Optional[str],
"field": Optional[str],
"log_count": Optional[str],
"distinct_value_count": Optional[str],
"top_values": [{ # optional
"value": Optional[str],
"count": Optional[str],
}],
"filterable": Optional[bool],
}],
}],
}
{
groups?: {
name?: string;
keys?: {
key?: string;
field?: string;
logCount?: string;
distinctValueCount?: string;
topValues?: {
value?: string;
count?: string;
}[];
filterable?: boolean;
}[];
}[];
}
List Facet Values
Return distinct values with occurrence counts for a given facet field.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.list_facet_values(field="<value>")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.listFacetValues({
field: "<value>",
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"field": str, # required
"limit": Optional[int],
"from_": date, # optional
"to": date, # optional
"search": Optional[str],
}
{
field: string; // required
limit?: number;
from?: Date;
to?: Date;
search?: string;
}
Show Response
Show Response
{
"values": [{ # optional
"value": Optional[str],
"count": Optional[str],
}],
}
{
values?: {
value?: string;
count?: string;
}[];
}
List Fields
Return all queryable fields: static columns and dynamic attribute families (attribute., resource.).from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.list_fields()
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.listFields();
console.log(result);
}
run();
Show Response
Show Response
{
"fields": [{ # optional
"name": Optional[str],
"type": Optional[str],
}],
}
{
fields?: {
name?: string;
type?: string;
}[];
}
Find Patterns
Find stable templates in a bounded sample of matching log bodies. The response reports sampling and truncation metadata and never returns an unbounded list of raw bodies.from orq_ai_sdk import Orq
from orq_ai_sdk.utils import parse_datetime
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.find_patterns(from_=parse_datetime("2024-10-05T00:49:57.596Z"), to=parse_datetime("2025-09-21T07:55:29.692Z"))
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.findPatterns({
from: new Date("2024-10-05T00:49:57.596Z"),
to: new Date("2025-09-21T07:55:29.692Z"),
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"from_": date, # required
"to": date, # required
"query": Optional[str],
"filter_operator": Optional[str],
"filters": [{ # optional
"field": Optional[str],
"op": Optional[str],
"values": List[str], # optional
}],
"limit": Optional[int],
}
{
from: Date; // required
to: Date; // required
query?: string;
filterOperator?: string;
filters?: {
field?: string;
op?: string;
values?: string[];
}[];
limit?: number;
}
Show Response
Show Response
{
"object": str,
"data": [{
"id": str,
"template": str,
"count": str,
"percentage": float,
"first_seen": date,
"last_seen": date,
"sample_log_ids": List[str],
"severity_summary": [{
"value": Optional[str],
"count": Optional[str],
}],
"service_summary": [{
"value": Optional[str],
"count": Optional[str],
}],
"suggested_query": Optional[str],
}],
"meta": {
"request_id": str,
"from_": date,
"to": date,
"total_count": str,
"sampled_count": str,
"truncated": bool,
"warnings": List[str],
},
}
{
object: string;
data: {
id: string;
template: string;
count: string;
percentage: number;
firstSeen: Date;
lastSeen: Date;
sampleLogIds: string[];
severitySummary: {
value?: string;
count?: string;
}[];
serviceSummary: {
value?: string;
count?: string;
}[];
suggestedQuery?: string;
}[];
meta: {
requestId: string;
from: Date;
to: Date;
totalCount: string;
sampledCount: string;
truncated: boolean;
warnings: string[];
};
}
Query Logs
Run an OQL log query using the pipeline grammarfetch logs | filter <expr> | sort timestamp desc | limit N. The query is compiled onto the same engine as SearchLogs; timestamp desc is the only supported sort.
from orq_ai_sdk import Orq
from orq_ai_sdk.utils import parse_datetime
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.query(oql="<value>", from_=parse_datetime("2025-08-17T16:51:30.424Z"), to=parse_datetime("2026-04-01T20:23:07.108Z"))
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.query({
oql: "<value>",
from: new Date("2025-08-17T16:51:30.424Z"),
to: new Date("2026-04-01T20:23:07.108Z"),
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"oql": str, # required
"from_": date, # required
"to": date, # required
"limit": Optional[int],
"page_token": Optional[str],
}
{
oql: string; // required
limit?: number;
from: Date; // required
to: Date; // required
pageToken?: string;
}
Show Response
Show Response
{
"object": Optional[str],
"search": { # optional
"object": Optional[str],
"data": [{ # optional
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
}],
"has_more": Optional[bool],
"next_page_token": Optional[str],
"meta": { # optional
"request_id": Optional[str],
"from_": date, # optional
"to": date, # optional
"row_count": Optional[int],
},
"total_count": Optional[str],
},
}
{
object?: string;
search?: {
object?: string;
data?: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
}[];
hasMore?: boolean;
nextPageToken?: string;
meta?: {
requestId?: string;
from?: Date;
to?: Date;
rowCount?: number;
};
totalCount?: string;
};
}
Search Logs
Query log records with filters, free-text search, and keyset pagination. Results are ordered timestamp desc (the only supported sort, mirroring traces).from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.search()
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.search({});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"from_": date, # optional
"to": date, # optional
"query": Optional[str],
"filter_operator": Optional[str],
"filters": [{ # optional
"field": Optional[str],
"op": Optional[str],
"values": List[str], # optional
}],
"sort": [{ # optional
"field": Optional[str],
"order": Optional[str],
}],
"limit": Optional[int],
"page_token": Optional[str],
}
{
from?: Date;
to?: Date;
query?: string;
filterOperator?: string;
filters?: {
field?: string;
op?: string;
values?: string[];
}[];
sort?: {
field?: string;
order?: string;
}[];
limit?: number;
pageToken?: string;
}
Show Response
Show Response
{
"object": Optional[str],
"data": [{ # optional
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
}],
"has_more": Optional[bool],
"next_page_token": Optional[str],
"meta": { # optional
"request_id": Optional[str],
"from_": date, # optional
"to": date, # optional
"row_count": Optional[int],
},
"total_count": Optional[str],
}
{
object?: string;
data?: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
}[];
hasMore?: boolean;
nextPageToken?: string;
meta?: {
requestId?: string;
from?: Date;
to?: Date;
rowCount?: number;
};
totalCount?: string;
}
Retrieve a Log
Retrieve a log record by its ULID. Returns 404 if the record does not exist or belongs to another workspace.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.get(id="<id>")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.get({
id: "<id>",
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"id": str, # required
}
{
id: string; // required
}
Show Response
Show Response
{
"log": { # optional
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
},
}
{
log?: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
};
}
Get Log Context
Retrieve the matching log records immediately before and after an anchor log. Neighbors use the same free-text and structured filter dialect as SearchLogs and are returned in chronological order.from orq_ai_sdk import Orq
from orq_ai_sdk.utils import parse_datetime
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.context(id="<id>", from_=parse_datetime("2025-04-02T17:30:56.013Z"), to=parse_datetime("2025-10-13T07:44:36.992Z"))
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.context({
id: "<id>",
getLogContextRequest: {
from: new Date("2025-04-02T17:30:56.013Z"),
to: new Date("2025-10-13T07:44:36.992Z"),
},
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"id": str, # required
"from_": date, # required
"to": date, # required
"query": Optional[str],
"filter_operator": Optional[str],
"filters": [{ # optional
"field": Optional[str],
"op": Optional[str],
"values": List[str], # optional
}],
"before": Optional[int],
"after": Optional[int],
"oql": Optional[str],
}
{
id: string; // required
getLogContextRequest: { // required
from: Date; // required
to: Date; // required
query?: string;
filterOperator?: string;
filters?: {
field?: string;
op?: string;
values?: string[];
}[];
before?: number;
after?: number;
oql?: string;
};
}
Show Response
Show Response
{
"anchor": {
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
},
"before": [{
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
}],
"after": [{
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
}],
"has_more_before": bool,
"has_more_after": bool,
}
{
anchor: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
};
before: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
}[];
after: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
}[];
hasMoreBefore: boolean;
hasMoreAfter: boolean;
}
List Trace Logs
Return all log records correlated with a given trace_id. Results are scoped to the authenticated workspace.from orq_ai_sdk import Orq
import os
with Orq(
api_key=os.getenv("ORQ_API_KEY", ""),
) as orq:
res = orq.logs.list_trace_logs(trace_id="<id>")
# Handle response
print(res)
import { Orq } from "@orq-ai/node";
const orq = new Orq({
apiKey: process.env["ORQ_API_KEY"] ?? "",
});
async function run() {
const result = await orq.logs.listTraceLogs({
traceId: "<id>",
});
console.log(result);
}
run();
Show Parameters
Show Parameters
{
"trace_id": str, # required
"limit": Optional[int],
"page_token": Optional[str],
}
{
traceId: string; // required
limit?: number;
pageToken?: string;
}
Show Response
Show Response
{
"object": Optional[str],
"data": [{ # optional
"id": Optional[str],
"trace_id": Optional[str],
"span_id": Optional[str],
"timestamp": date, # optional
"observed_timestamp": date, # optional
"severity_number": Optional[int],
"severity_text": Optional[str],
"body": Optional[str],
"body_is_json": Optional[bool],
"event_name": Optional[str],
"dropped_attributes_count": Optional[int],
"trace_flags": Optional[int],
"scope_name": Optional[str],
"scope_version": Optional[str],
"scope_attributes": Dict[str, str], # optional
"log_attributes": Dict[str, str], # optional
"resource_attributes": Dict[str, str], # optional
"service_name": Optional[str],
"service_version": Optional[str],
"deployment_environment": Optional[str],
"host_name": Optional[str],
"project_id": Optional[str],
}],
"has_more": Optional[bool],
"next_page_token": Optional[str],
}
{
object?: string;
data?: {
id?: string;
traceId?: string;
spanId?: string;
timestamp?: Date;
observedTimestamp?: Date;
severityNumber?: number;
severityText?: string;
body?: string;
bodyIsJson?: boolean;
eventName?: string;
droppedAttributesCount?: number;
traceFlags?: number;
scopeName?: string;
scopeVersion?: string;
scopeAttributes?: Record<string, string>;
logAttributes?: Record<string, string>;
resourceAttributes?: Record<string, string>;
serviceName?: string;
serviceVersion?: string;
deploymentEnvironment?: string;
hostName?: string;
projectId?: string;
}[];
hasMore?: boolean;
nextPageToken?: string;
}