search_logs
Search log streams across OpenObserve instances using SQL. Automatically selects efficient query strategy based on time range: raw fetch, sampling, or aggregation.
Instructions
Search log streams with SQL across one or more OpenObserve instances. Automatically applies the most efficient query strategy based on time range: raw fetch for ≤1 h, sampling for 1–6 h, hourly aggregation for 6 h–7 d, daily aggregation beyond 7 d. SQL supports =, !=, >, <, >=, <=, IS NULL, IS NOT NULL, AND, OR, NOT, COUNT, SUM, AVG, MIN, MAX, GROUP BY, ORDER BY, histogram(_timestamp). String values use single quotes; stream names use double quotes. match_all('text') performs full-text search across indexed fields with wildcard support (). Do not add WHERE _timestamp filters — time range is handled by startTime and endTime parameters. Examples: SELECT * FROM "mystream" WHERE match_all('error') | SELECT code, COUNT(*) FROM "mystream" GROUP BY code
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | SQL query to execute | |
| limit | No | Results per instance (applies to raw strategy only) | |
| cursor | No | Pagination cursor from previous response | |
| endTime | Yes | End time (ISO 8601 or Unix ms) | |
| instances | Yes | Instance IDs to query | |
| startTime | Yes | Start time (ISO 8601 or Unix ms) | |
| bypassCache | No | Skip cache lookup | |
| trackTotalHits | No | Compute exact total hit count; slower on large streams |