Querying logs

Use a credential with logs:read for the destination resource. A sender token with only logs:write cannot query events.

curl --fail-with-body --get \
  "$ALSHIVAL_BASE_URL/v1/workspaces/$ALSHIVAL_WORKSPACE_ID/resources/$ALSHIVAL_RESOURCE_ID/logs" \
  -H "Authorization: Bearer $ALSHIVAL_READ_TOKEN" \
  --data-urlencode 'severity=ERROR' \
  --data-urlencode 'q=timeout' \
  --data-urlencode 'limit=50'

Filters and pagination

Parameter	Behavior
`start`, `end`	Time bounds; use timezone-aware ISO timestamps such as `2026-10-12T00:00:00Z`.
`severity`	One canonical uppercase severity.
`q`	Message search, up to 500 characters.
`trace_id`	Exact 32-character lowercase hexadecimal trace ID.
`limit`	1–200; default 100.
`cursor`	Opaque continuation returned by the same destination.

Responses contain items, next_cursor, and retention. Pass next_cursor as the next request's cursor, preserving the original filters. Stop when it is null. Start a fresh query to see newer arrivals. Do not decode cursors or reuse them across destinations or resources.

Cloud retention depends on workspace policy and quotas. Local logs use device retention and disk limits. A successful empty query can mean filters excluded the events or retention removed them; it does not prove ingestion failed.