Running queries through the UI in IBM Cloud Logs

In IBM Cloud Logs, you can query data through the Logs Explorer page by using any of the following options:

• Querying data by using Lucene queries

• Querying data by using DataPrime queries

In the Logs Explorer > Logs page, you can choose any of the following options to query data:

• You can monitor Priority insights data through the Priority Insights option.

• You can monitor data through the All Logs option that is available in the COS data bucket and ingested through any data pipeline.

Running synchronous queries through the CLI in IBM Cloud Logs

You can query logs synchronously by runing the ibmcloud logs query command.

ibmcloud logs query ibmcloud cloud-logs query [--query "DATAPRIME_OR_LUCENE_QUERY"] \
[--metadata '{ --start-date START-DATE
               --end-date END-DATE
               --default-source DEFAULT-SOURCE
               --tier TIER
               --syntax SYNTAX
               --limit LIMIT
               --strict-fields-validation STRICT-FIELDS-VALIDATION
             }'

Where

--query (string)

Defines the query to be run.

The maximum length is 4096 characters.

--metadata (string)

Metadata for the query execution. Use this configuration to provide the query execution parameters.

--start-date (string)

Beginning of the time range for the query.

This must be in UTC ISO 8601 format, for example: 2025-07-15T08:45:00Z.

The default is 15 minutes before the --end-date value.

If --end-date is not specified, the default value is 15 minutes before the current time.

--end-date (string)

End of the time range for the query.

This must be in UTC ISO 8601 format, for example: 2025-07-15T08:45:00Z.

The default is 15 minutes after the --start-date value.

If --start-date is not defined the --end-date is the current-time and the --start-date is 15 minutes prior to current time.

--limit (int)

Limit the number of records returned.

If not specified, the default value is 2000.

The maximum number of records returned when searching Priority insights is 12000. Otherwise the maximum number of records returned is: 50000.

--default-source (string)

Default value for the source to use when the source is omitted in a query.

The maximum length is 4096 characters.

--syntax (string)

The syntax in which the query is written.

Valid values are: unspecified, lucene, dataprime.

--since (duration)

Duration to look back from the current time when querying data.

Using this flag overrides the metadata-start-date and metadata-end-date.

For example, 1h retrieves data from the past hour.

The default value is set to 1h0m0s.

--tier (string)

Tier on which the query runs.

Valid values are: archive, and frequent_search (Priority insights).

--strict-fields-validation (boolean)

Controls the fields that can be used in queries.

When is set to false, you cannot use fields that are not detected in the ingested data.

The default value is set to false.

--output (string)

The output format in which the results are returned. Valid values are logs-raw , logs-prettify and json.

For example, you can run the following samples:

ibmcloud logs query --query "Push and Query test" --metadata '{"start_date": "2025-06-16T12:00:00Z", "end_date": "2025-06-17T13:41:30Z","syntax": "lucene"}' --output logs-raw

ibmcloud logs query --query "source logs | filter \$d.text == 'Push and Query test'" --syntax dataprime --start-date 2025-08-03T12:00:00Z  --end-date 2025-08-04T13:41:30Z

ibmcloud logs query --query 'severity:ERROR AND applicationName:permission-service AND NOT message:"connection reset"' --syntax lucene --since 1h

Running synchronous queries through the API in IBM Cloud Logs

You can query logs synchronously by running the API method ${URL}/v1/query.

curl -X POST --location --header "Authorization: Bearer ${iam_token}"   --header "Accept: text/event-stream"   --header "Content-Type: application/json"   --data   '{
    "metadata": {
      "end_date": "END_DATE",
      "limit": LIMIT,
      "start_date": "START_DATE",
      "strict_fields_validation": false,
      "syntax": "QUERY_SYNTAX",
      "tier": "TIER"
    },
    "query": "QUERY"
  }'   "${base_url}/v1/query"