Searching for Logs

Function

CSS supports log backup and query, helping you efficiently locate issues. You can periodically back up cluster logs to OBS buckets for long-term storage, from which you download log data for troubleshooting or auditing purposes. You can also query cluster logs through an API. You can search for specific run logs by specifying a time period, node names, and log levels. This helps you quickly locate faults or performance bottlenecks. This API is used to query cluster logs by specifying the node name, log level, and log type.

Calling Method

For details, see Calling APIs.

URI

POST /v1.0/{project_id}/clusters/{cluster_id}/logs/search

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Definition Project ID. For details about how to obtain the project ID and name, see Obtaining the Project ID and Name. Constraints N/A Range Project ID of an account. The value contains 32 characters, consisting of lowercase letters and digits. Default Value N/A
cluster_id	Yes	String	Definition ID of the cluster to be queried. For details about how to obtain the cluster ID, see Obtaining the Cluster ID. Constraints N/A Range The value is a UUID containing 36 characters. Default Value N/A

Request Parameters

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
instance_name	Yes	String	Definition: Node name. Obtain the name attribute in instances by referring to Querying Cluster Details. Constraints: N/A Value range: N/A Default value: N/A
level	No	String	Definition Log level to query. Constraints When log_type is deprecation , only ALL is supported. This parameter does not take effect when querying a Logstash cluster. For Logstash clusters, all log levels are queried by default. NOTE: You can combine multiple log levels using \| , for example, WARN\|ERROR , which means logs at both WARN and ERROR levels are queried. ALL cannot be combined with other values. Before querying TRACE logs, you must enable TRACE logging. Then use ALL to query all log levels and locate TRACE-level logs. To enable TRACE logging for an Elasticsearch cluster, see DEBUG: Query logs at the DEBUG level. INFO: Query logs at the INFO level. WARN: Query logs at the WARN level. ERROR: Query logs at the ERROR level. ALL: All log levels, including DEBUG, INFO, WARN, ERROR, and TRACE logs. ALL . To enable TRACE logging for an OpenSearch cluster, see .RangeDefault Value
log_type	Yes	String	Definition Log type to query. Constraints This parameter does not take effect when querying a Logstash cluster. Deprecation logs can be queried only when all log levels are queried. Range deprecation: Query deprecation logs. indexingSlow: Query slow indexing logs. searchSlow: Query slow query logs. instance: Query run logs. Default Value N/A
limit	No	Integer	Definition Number of logs to be returned. Constraints A maximum of 10,000 logs can be returned, and the log size cannot exceed 1 MB. Range 1 to 10000 Default Value 100
time_index	No	String	Definition Logs generated before the specified time are returned. The time format is yyyy-MM-ddTHH:mm:ss,SSS. Constraints N/A Range N/A Default Value N/A
keyword	No	String	Definition: Keyword used for filtering. Constraints: N/A Value range: Only letters, digits, underscores (_), hyphens (-), periods (.), spaces, and square brackets are allowed. Maximum length: 64 characters. Default value: N/A

Response Parameters

Status code: 200

**Table 3** Response body parameters
Parameter	Type	Description
logList	Array of logList objects	Definition Log list, including the log content, log level, and log date. Range N/A
type	String	Definition: Queried log type. Value range: deprecation: Queries deprecation logs. indexingSlow: Queries slow indexing logs. searchSlow: Queries slow query logs. instance: Queries run logs.
completed	Boolean	Definition: Whether all log files have been queried. Value range: true: All log files have been queried. There are no more results. false: Only some of the log files have been queried. The query result is returned because the number of requested records has been reached or the log size has reached 1 MB.

**Table 4** logList
Parameter	Type	Description
content	String	Parameter description: Log content. Options: N/A
date	String	Definition Log generation date, in the format yyyy-MM-ddTHH:mm:ss,SSS. Range N/A
level	String	Definition: Queried log level. Value range: DEBUG: DEBUG logs. INFO: INFO logs. WARN: WARN logs. ERROR: ERROR logs. TRACE: TRACE logs.

Example Requests

Query logs by node name, log level, and log type.

POST https://{Endpoint}/v1.0/{project_id}/clusters/4f3deec3-efa8-4598-bf91-560aad1377a3/logs/search

{
  "instance_name" : "css-4312-ess-esn-1-1",
  "level" : "INFO",
  "log_type" : "instance",
  "limit" : 10,
  "time_index" : "2025-08-25T01:07:19,082",
  "keyword" : "received"
}

Example Responses

Status code: 200

Request succeeded.

{
  "logList" : [ {
    "content" : "xxxxxx",
    "date" : "2021-10-08T03:55:54,718",
    "level" : "INFO"
  } ],
  "type" : "instance",
  "completed" : true
}

Status Codes

Status Code	Description
200	Request succeeded.
400	Invalid request. Modify the request before retry.
409	The request could not be completed due to a conflict with the current state of the resource. The resource that the client attempts to create already exists, or the update request fails to be processed because of a conflict.
412	The server did not meet one of the preconditions contained in the request.

Error Codes

See Error Codes.

Parent topic: Log Management

Previous topic: Backing Up Logs

Next topic: Log Ingestion Connectivity Testing