List Observability Logs
list_observability_logsSearch Rootly Observability logs by service, severity, index, trace ID, attributes, or free text, then page through newest-first results within a specified time window.
Instructions
Search Rootly Observability logs with the Logs explorer query syntax (service:, severity:, index:, trace_id:, @attribute:value, OR inside field groups, - negation, * prefix, free text). Rows are newest first, clipped and redacted. meta.query and meta.window echo the effective query and window. Requires a personal or Global API key (Team API Keys are group-scoped and get 403 unsupported_api_key) or an OAuth token with the obs.logs:read (or all) scope, and the Observability logs read permission. A Global API key uses its service user's Observability role, which starts as the team's default Observability role. Limited to 60 requests per minute per token; on this endpoint the X-RateLimit-* headers report that per-minute budget, not the default API limit. Every 429 returns the errors envelope with code rate_limited and a Retry-After header.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filter_to | No | Window end: ISO8601 or relative like `now`. Defaults to `now`. | |
| page_size | No | Maximum rows per page (1-50, default 25). A page can hold fewer rows when the response size budget is reached; keep paging while meta.page.next_cursor is present. | |
| filter_from | No | Window start: ISO8601 or relative like `now-6h`, `now-30m`, `now-2d`. Defaults to `now-1h`. Windows are at most 7 days, and 24 hours without an indexable term. | |
| page_cursor | No | `meta.page.next_cursor` from the previous page. Keeps that page's window; send the same `filter[query]`. | |
| filter_query | No | Logs explorer query, e.g. `service:checkout severity:error index:main`. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||