Query limits

Characters within a query

There are limits to the number of characters that can be included in a query.

• A maximum of 3000 characters can be included in a query in the Logs view.

• A maxumum of 65,535 characters can be included in an alert query definition. Alert query definitions are also limited to a maximum of 50 AND and OR statements.

Keyword types

Keywords represent text that does not pass through the analyzer before indexing. This data type is suitable for regular expressions, aggregation, and sorting.

The syntax to use the keyword data type in your query is: <fieldName>.keyword.

IBM Cloud Logs can not create a keyword type when a field is longer than 256 characters.

Results returned

The maximum number of rows that are returned from a query depends if you are querying from Priority insights or data that is stored in IBM Cloud Object Storage.

• The maximum number of results that are returned from Priority insights is 12 K.
• The maximum number of results that are returned from IBM Cloud Object Storage (from a query using All Logs) is 50 K.

Bytes scanned

A maximum of 100 MB is scanned for Priority insights data. No limit exists when data stored in IBM Cloud Object Storage is scanned.

Rate limiting

A maximum of 10 queries per minute can be submitted.

When the rate limit is exceeded, an HTTP 429 is returned.