• Home
  • Dynatrace API
  • Environment
  • Log Monitoring
  • GET export logs

Log Monitoring API - GET export logs

Gets the log records matching the provided criteria. Matching log records are sorted by the criteria specified in the sort query parameter.

Unlike the GET search logs request, this one does not impose a limit on the total number of resulting log records. However, if the resulting log is too large, pagination is applied. You can set the page size in the pageSize query parameter. In such cases, the first response contains the nextPageKey for the second page. Use it in the nextPageKey query parameter to obtain the second page, which in turn contains the nextPageKey for the third page, and so on.

The request produces an application/json payload.

This request is an Early Adopter release and may be changed in non-compatible way.

GET

  • Dynatrace SaaS https://{your-environment-id}.live.dynatrace.com/api/v2/logs/export
  • Environment ActiveGate https://{your-activegate-domain}/e/{your-environment-id}/api/v2/logs/export

Authentication

To execute this request, you need the Read logs (logs.read) permission assigned to your API token. To learn how to obtain and use it, see Tokens and authentication.

Parameters

ParameterTypeDescriptionInRequired
fromstring

The start of the requested timeframe.

You can use one of the following formats:

  • Timestamp in UTC milliseconds.
  • Human-readable format of 2021-01-25T05:57:01.123+01:00. If no time zone is specified, UTC is used. You can use a space character instead of the T. Seconds and fractions of a second are optional.
  • Relative timeframe, back from now. The format is now-NU/A, where N is the amount of time, U is the unit of time, and A is an alignment. The alignment rounds all the smaller values to the nearest zero in the past. For example, now-1y/w is one year back, aligned by a week. You can also specify relative timeframe without an alignment: now-NU. Supported time units for the relative timeframe are:
    • m: minutes
    • h: hours
    • d: days
    • w: weeks
    • M: months
    • y: years

If not set, the relative timeframe of two weeks is used (now-2w).

queryoptional
tostring

The end of the requested timeframe.

You can use one of the following formats:

  • Timestamp in UTC milliseconds.
  • Human-readable format of 2021-01-25T05:57:01.123+01:00. If no time zone is specified, UTC is used. You can use a space character instead of the T. Seconds and fractions of a second are optional.
  • Relative timeframe, back from now. The format is now-NU/A, where N is the amount of time, U is the unit of time, and A is an alignment. The alignment rounds all the smaller values to the nearest zero in the past. For example, now-1y/w is one year back, aligned by a week. You can also specify relative timeframe without an alignment: now-NU. Supported time units for the relative timeframe are:
    • m: minutes
    • h: hours
    • d: days
    • w: weeks
    • M: months
    • y: years

If not set, the current timestamp is used.

queryoptional
nextPageKeystring

The cursor for the next page of results. You can find it in the nextPageKey field of the previous response.

The first page is always returned if you don't specify the nextPageKey query parameter.

When the nextPageKey is set to obtain subsequent pages, you must omit all other query parameters.

queryoptional
pageSizeinteger

The number of results per result page.

queryoptional
querystring

The log search query.

The query must use the Dynatrace search query language.

queryoptional
sortstring

Defines the ordering of the log records.

Each field has a sign prefix (+/-) for sorting order. If no sign prefix is set, then the + option will be applied.

Currently, ordering is available only for the timestamp (+timestamp for the oldest records first, or -timestamp for the newest records first).

When millisecond resolution provided by the timestamp is not enough, log records are sorted based on the order in which they appear in the log source (remote process writing to REST API endpoint or remote process from which logs are collected).

queryoptional

Response

Response codes

CodeTypeDescription
200ExportedLogRecordList

Success

400ErrorEnvelope

Failed. The input is invalid.

501ErrorEnvelope

Failed. The server either does not recognize the request method, or it lacks the ability to fulfill the request. May happen when Grail log storage is enabled.

Response body objects

The ExportedLogRecordList object

A list of exported log records.

ElementTypeDescription
resultsLogRecord[]

A list of retrieved log records.

nextPageKeystring

The cursor for the next page of results. Has the value of null on the last page.

Use it in the nextPageKey query parameter to obtain subsequent pages of the result.

pageSizeinteger

The number of entries per page.

totalCountinteger

The total number of entries in the result.

The LogRecord object

A single log record.

ElementTypeDescription
additionalColumnsobject

Additional columns of the log record.

eventTypestring

Type of event

The element can hold these values
  • K8S
  • LOG
  • SFM
timestampinteger

The timestamp of the log record, in UTC milliseconds.

statusstring

The log status (based on the log level).

The element can hold these values
  • ERROR
  • INFO
  • NONE
  • WARN
contentstring

The content of the log record.

Response body JSON model

json
{ "results": [ { "timestamp": "1631193089000", "status": "ERROR", "content": "example log content", "event.type": "LOG", "additionalColumns": { "custom.attribute": [ "value1", "value2" ], "loglevel": [ "SEVERE" ] } } ], "pageSize": 100, "nextPageKey": "___-2lZ43q0AAAAdeJxjYAAC1sLS1KJKBhjggtIijFCGHEwCAFiHAoP___7aVnjerQ", "totalCount": 150 }
Related topics
  • Log Monitoring Classic

    Learn how to enable Log Monitoring, the insights that Log Monitoring can provide, and more.