Execute a query

curl --request POST \
  --url https://api.eu.bronto.io/search \
  --header 'Content-Type: application/json' \
  --header 'X-BRONTO-API-KEY: <api-key>' \
  --data @- <<EOF
{
  "select": [
    "min(response_time_ms)",
    "avg(response_time_ms)",
    "max(response_time_ms)"
  ],
  "from": [
    "[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]"
  ],
  "from_tags": [
    "environment:production"
  ],
  "time_range": "Last 10 minutes",
  "from_ts": 1709251200000,
  "to_ts": 1711390455601,
  "where": "ip='10.0.0.1'",
  "groups": [
    "[user, ip]"
  ],
  "limit": 50,
  "num_of_slices": 50,
  "from_sequence": 111721913,
  "most_recent_first": true,
  "explain_only": true,
  "async_enabled": false
}
EOF

import requests

url = "https://api.eu.bronto.io/search"

payload = {
    "select": ["min(response_time_ms)", "avg(response_time_ms)", "max(response_time_ms)"],
    "from": ["[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]"],
    "from_tags": ["environment:production"],
    "time_range": "Last 10 minutes",
    "from_ts": 1709251200000,
    "to_ts": 1711390455601,
    "where": "ip='10.0.0.1'",
    "groups": ["[user, ip]"],
    "limit": 50,
    "num_of_slices": 50,
    "from_sequence": 111721913,
    "most_recent_first": True,
    "explain_only": True,
    "async_enabled": False
}
headers = {
    "X-BRONTO-API-KEY": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-BRONTO-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    select: ['min(response_time_ms)', 'avg(response_time_ms)', 'max(response_time_ms)'],
    from: ['[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]'],
    from_tags: ['environment:production'],
    time_range: 'Last 10 minutes',
    from_ts: 1709251200000,
    to_ts: 1711390455601,
    where: 'ip=\'10.0.0.1\'',
    groups: ['[user, ip]'],
    limit: 50,
    num_of_slices: 50,
    from_sequence: 111721913,
    most_recent_first: true,
    explain_only: true,
    async_enabled: false
  })
};

fetch('https://api.eu.bronto.io/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.eu.bronto.io/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'select' => [
        'min(response_time_ms)',
        'avg(response_time_ms)',
        'max(response_time_ms)'
    ],
    'from' => [
        '[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]'
    ],
    'from_tags' => [
        'environment:production'
    ],
    'time_range' => 'Last 10 minutes',
    'from_ts' => 1709251200000,
    'to_ts' => 1711390455601,
    'where' => 'ip=\'10.0.0.1\'',
    'groups' => [
        '[user, ip]'
    ],
    'limit' => 50,
    'num_of_slices' => 50,
    'from_sequence' => 111721913,
    'most_recent_first' => true,
    'explain_only' => true,
    'async_enabled' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-BRONTO-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.eu.bronto.io/search"

	payload := strings.NewReader("{\n  \"select\": [\n    \"min(response_time_ms)\",\n    \"avg(response_time_ms)\",\n    \"max(response_time_ms)\"\n  ],\n  \"from\": [\n    \"[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]\"\n  ],\n  \"from_tags\": [\n    \"environment:production\"\n  ],\n  \"time_range\": \"Last 10 minutes\",\n  \"from_ts\": 1709251200000,\n  \"to_ts\": 1711390455601,\n  \"where\": \"ip='10.0.0.1'\",\n  \"groups\": [\n    \"[user, ip]\"\n  ],\n  \"limit\": 50,\n  \"num_of_slices\": 50,\n  \"from_sequence\": 111721913,\n  \"most_recent_first\": true,\n  \"explain_only\": true,\n  \"async_enabled\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-BRONTO-API-KEY", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.eu.bronto.io/search")
  .header("X-BRONTO-API-KEY", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"select\": [\n    \"min(response_time_ms)\",\n    \"avg(response_time_ms)\",\n    \"max(response_time_ms)\"\n  ],\n  \"from\": [\n    \"[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]\"\n  ],\n  \"from_tags\": [\n    \"environment:production\"\n  ],\n  \"time_range\": \"Last 10 minutes\",\n  \"from_ts\": 1709251200000,\n  \"to_ts\": 1711390455601,\n  \"where\": \"ip='10.0.0.1'\",\n  \"groups\": [\n    \"[user, ip]\"\n  ],\n  \"limit\": 50,\n  \"num_of_slices\": 50,\n  \"from_sequence\": 111721913,\n  \"most_recent_first\": true,\n  \"explain_only\": true,\n  \"async_enabled\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.eu.bronto.io/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-BRONTO-API-KEY"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"select\": [\n    \"min(response_time_ms)\",\n    \"avg(response_time_ms)\",\n    \"max(response_time_ms)\"\n  ],\n  \"from\": [\n    \"[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]\"\n  ],\n  \"from_tags\": [\n    \"environment:production\"\n  ],\n  \"time_range\": \"Last 10 minutes\",\n  \"from_ts\": 1709251200000,\n  \"to_ts\": 1711390455601,\n  \"where\": \"ip='10.0.0.1'\",\n  \"groups\": [\n    \"[user, ip]\"\n  ],\n  \"limit\": 50,\n  \"num_of_slices\": 50,\n  \"from_sequence\": 111721913,\n  \"most_recent_first\": true,\n  \"explain_only\": true,\n  \"async_enabled\": false\n}"

response = http.request(request)
puts response.read_body

{
  "explain": {
    "Execution time (millis)": "353"
  },
  "result": [
    {
      "@time": "2024-03-27 10:25:40.632 UTC",
      "@sequence": "111721913",
      "@raw": "10.0.0.1 - - [27/Mar/2024:10:54:39 +0000] \"GET / HTTP/1.1\" 200 721 \"-\" \"ELB-HealthChecker/2.0\"",
      "@context": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both",
      "metadata": {
        "logId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "timestamp": 1711535140632,
        "sequence": 111721913,
        "origin": "10.0.0.1",
        "context": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both",
        "selectedKeys": {
          "@time": "2024-03-27 10:25:40.632 UTC"
        },
        "unselectedKeys": {
          "id": "message_0",
          "current_time": 1711535140
        }
      },
      "links": [
        {
          "rel": "context",
          "href": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both"
        }
      ]
    }
  ],
  "events": [
    {
      "@raw": "10.0.108.203 - - [27/May/2024:23:47:27 +0000] \"GET / HTTP/1.1\" 200 675 \"-\" \"ELB-HealthChecker/2.0\"",
      "@time": "2024-05-27 23:26:34.331 UTC",
      "@status": "info",
      "message_kvs": {
        "method": "GET",
        "statusCode": "200",
        "path": "/"
      },
      "attributes": {
        "$private_ip": "10.0.22.230",
        "$environment": "production"
      },
      "metadata": {
        "service_id": "23746675-7022-4985-bd74-4af9eba58d72",
        "timestamp": 1716853347801,
        "sequence": 111721913,
        "context": "\"https://api.eu.bronto.io/context?sequence=213&from=37bdf479-7c95-4e81-982a-25d0680fb602&timestamp=1716853354331&direction=both\"\n"
      },
      "links": [
        {
          "rel": "context",
          "href": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both"
        }
      ]
    }
  ],
  "groups": [
    {
      "group": "[US]",
      "count": 124,
      "stat": "average(bytes)",
      "value": 50325.25,
      "timeseries": [
        {
          "@timestamp": "1711535140632",
          "count": 40,
          "value": 35.625,
          "quantiles": {
            "min": 691,
            "p25": 713.75,
            "p50": 796,
            "p75": 847.5,
            "p90": 1237,
            "p95": 1331,
            "p99": 1331,
            "p999": 1331,
            "max": 1331
          }
        }
      ]
    }
  ],
  "groups_series": [
    {
      "name": "host123",
      "count": 124,
      "stat": "average(duration_millis)",
      "value": 50325.25,
      "quantiles": {
        "min": 691,
        "p25": 713.75,
        "p50": 796,
        "p75": 847.5,
        "p90": 1237,
        "p95": 1331,
        "p99": 1331,
        "p999": 1331,
        "max": 1331
      },
      "series_resolution_ms": 60000,
      "timeseries": [
        {
          "@timestamp": "1711535140632",
          "count": 40,
          "value": 35.625,
          "quantiles": {
            "min": 691,
            "p25": 713.75,
            "p50": 796,
            "p75": 847.5,
            "p90": 1237,
            "p95": 1331,
            "p99": 1331,
            "p999": 1331,
            "max": 1331
          }
        }
      ],
      "groups_series": [
        {
          "name": "host123",
          "count": 124,
          "stat": "average(duration_millis)",
          "value": 50325.25,
          "series_resolution_ms": 60000,
          "timeseries": [
            {
              "@timestamp": "1711535140632",
              "count": 40,
              "value": 35.625,
              "quantiles": {
                "min": 691,
                "p25": 713.75,
                "p50": 796,
                "p75": 847.5,
                "p90": 1237,
                "p95": 1331,
                "p99": 1331,
                "p999": 1331,
                "max": 1331
              }
            }
          ]
        }
      ]
    }
  ],
  "metadata": {
    "select": [
      "host",
      "status",
      "method"
    ],
    "correlation_id": "00000000-0000-0000-0000-000000000000"
  },
  "totals": {},
  "pagination": {
    "next_page_url": "<string>"
  },
  "links": [
    {
      "rel": "next",
      "href": "<string>"
    }
  ]
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

Execute a query

You can execute queries on your log data by using Bronto’s syntax based on a subset of SQL as described in the documentation https://docs.bronto.io/query-syntax/overview

Bronto supports both the GET and POST methods for executing a query, however the POST method is preferred as it avoids problems related to maximum URL length when the query parameters are very long.

In the context of the REST API, there are three distinct types queries which determine which parts of the response object are populated:

Event search queries return a list of events matching the specified filter. The response will be paginated if more than limit (default 50) matching events are returned.
Aggregate queries apply aggregate functions such as count(), sum(), max(), avg() to your log data, and return a number or a timeseries of numbers.
Group by aggregate queries return numerical results grouped according to the values for the attributes specified in the group by clause.

The query type is determined by the combination of the select and groups parameters.

POST

Execute a query

curl --request POST \
  --url https://api.eu.bronto.io/search \
  --header 'Content-Type: application/json' \
  --header 'X-BRONTO-API-KEY: <api-key>' \
  --data @- <<EOF
{
  "select": [
    "min(response_time_ms)",
    "avg(response_time_ms)",
    "max(response_time_ms)"
  ],
  "from": [
    "[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]"
  ],
  "from_tags": [
    "environment:production"
  ],
  "time_range": "Last 10 minutes",
  "from_ts": 1709251200000,
  "to_ts": 1711390455601,
  "where": "ip='10.0.0.1'",
  "groups": [
    "[user, ip]"
  ],
  "limit": 50,
  "num_of_slices": 50,
  "from_sequence": 111721913,
  "most_recent_first": true,
  "explain_only": true,
  "async_enabled": false
}
EOF

import requests

url = "https://api.eu.bronto.io/search"

payload = {
    "select": ["min(response_time_ms)", "avg(response_time_ms)", "max(response_time_ms)"],
    "from": ["[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]"],
    "from_tags": ["environment:production"],
    "time_range": "Last 10 minutes",
    "from_ts": 1709251200000,
    "to_ts": 1711390455601,
    "where": "ip='10.0.0.1'",
    "groups": ["[user, ip]"],
    "limit": 50,
    "num_of_slices": 50,
    "from_sequence": 111721913,
    "most_recent_first": True,
    "explain_only": True,
    "async_enabled": False
}
headers = {
    "X-BRONTO-API-KEY": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-BRONTO-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    select: ['min(response_time_ms)', 'avg(response_time_ms)', 'max(response_time_ms)'],
    from: ['[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]'],
    from_tags: ['environment:production'],
    time_range: 'Last 10 minutes',
    from_ts: 1709251200000,
    to_ts: 1711390455601,
    where: 'ip=\'10.0.0.1\'',
    groups: ['[user, ip]'],
    limit: 50,
    num_of_slices: 50,
    from_sequence: 111721913,
    most_recent_first: true,
    explain_only: true,
    async_enabled: false
  })
};

fetch('https://api.eu.bronto.io/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.eu.bronto.io/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'select' => [
        'min(response_time_ms)',
        'avg(response_time_ms)',
        'max(response_time_ms)'
    ],
    'from' => [
        '[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]'
    ],
    'from_tags' => [
        'environment:production'
    ],
    'time_range' => 'Last 10 minutes',
    'from_ts' => 1709251200000,
    'to_ts' => 1711390455601,
    'where' => 'ip=\'10.0.0.1\'',
    'groups' => [
        '[user, ip]'
    ],
    'limit' => 50,
    'num_of_slices' => 50,
    'from_sequence' => 111721913,
    'most_recent_first' => true,
    'explain_only' => true,
    'async_enabled' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-BRONTO-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.eu.bronto.io/search"

	payload := strings.NewReader("{\n  \"select\": [\n    \"min(response_time_ms)\",\n    \"avg(response_time_ms)\",\n    \"max(response_time_ms)\"\n  ],\n  \"from\": [\n    \"[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]\"\n  ],\n  \"from_tags\": [\n    \"environment:production\"\n  ],\n  \"time_range\": \"Last 10 minutes\",\n  \"from_ts\": 1709251200000,\n  \"to_ts\": 1711390455601,\n  \"where\": \"ip='10.0.0.1'\",\n  \"groups\": [\n    \"[user, ip]\"\n  ],\n  \"limit\": 50,\n  \"num_of_slices\": 50,\n  \"from_sequence\": 111721913,\n  \"most_recent_first\": true,\n  \"explain_only\": true,\n  \"async_enabled\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-BRONTO-API-KEY", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.eu.bronto.io/search")
  .header("X-BRONTO-API-KEY", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"select\": [\n    \"min(response_time_ms)\",\n    \"avg(response_time_ms)\",\n    \"max(response_time_ms)\"\n  ],\n  \"from\": [\n    \"[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]\"\n  ],\n  \"from_tags\": [\n    \"environment:production\"\n  ],\n  \"time_range\": \"Last 10 minutes\",\n  \"from_ts\": 1709251200000,\n  \"to_ts\": 1711390455601,\n  \"where\": \"ip='10.0.0.1'\",\n  \"groups\": [\n    \"[user, ip]\"\n  ],\n  \"limit\": 50,\n  \"num_of_slices\": 50,\n  \"from_sequence\": 111721913,\n  \"most_recent_first\": true,\n  \"explain_only\": true,\n  \"async_enabled\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.eu.bronto.io/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-BRONTO-API-KEY"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"select\": [\n    \"min(response_time_ms)\",\n    \"avg(response_time_ms)\",\n    \"max(response_time_ms)\"\n  ],\n  \"from\": [\n    \"[550e8400-e29b-41d4-a716-446655440000, 297bb888-83b1-44e0-8ab6-47879f1275a2]\"\n  ],\n  \"from_tags\": [\n    \"environment:production\"\n  ],\n  \"time_range\": \"Last 10 minutes\",\n  \"from_ts\": 1709251200000,\n  \"to_ts\": 1711390455601,\n  \"where\": \"ip='10.0.0.1'\",\n  \"groups\": [\n    \"[user, ip]\"\n  ],\n  \"limit\": 50,\n  \"num_of_slices\": 50,\n  \"from_sequence\": 111721913,\n  \"most_recent_first\": true,\n  \"explain_only\": true,\n  \"async_enabled\": false\n}"

response = http.request(request)
puts response.read_body

{
  "explain": {
    "Execution time (millis)": "353"
  },
  "result": [
    {
      "@time": "2024-03-27 10:25:40.632 UTC",
      "@sequence": "111721913",
      "@raw": "10.0.0.1 - - [27/Mar/2024:10:54:39 +0000] \"GET / HTTP/1.1\" 200 721 \"-\" \"ELB-HealthChecker/2.0\"",
      "@context": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both",
      "metadata": {
        "logId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "timestamp": 1711535140632,
        "sequence": 111721913,
        "origin": "10.0.0.1",
        "context": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both",
        "selectedKeys": {
          "@time": "2024-03-27 10:25:40.632 UTC"
        },
        "unselectedKeys": {
          "id": "message_0",
          "current_time": 1711535140
        }
      },
      "links": [
        {
          "rel": "context",
          "href": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both"
        }
      ]
    }
  ],
  "events": [
    {
      "@raw": "10.0.108.203 - - [27/May/2024:23:47:27 +0000] \"GET / HTTP/1.1\" 200 675 \"-\" \"ELB-HealthChecker/2.0\"",
      "@time": "2024-05-27 23:26:34.331 UTC",
      "@status": "info",
      "message_kvs": {
        "method": "GET",
        "statusCode": "200",
        "path": "/"
      },
      "attributes": {
        "$private_ip": "10.0.22.230",
        "$environment": "production"
      },
      "metadata": {
        "service_id": "23746675-7022-4985-bd74-4af9eba58d72",
        "timestamp": 1716853347801,
        "sequence": 111721913,
        "context": "\"https://api.eu.bronto.io/context?sequence=213&from=37bdf479-7c95-4e81-982a-25d0680fb602&timestamp=1716853354331&direction=both\"\n"
      },
      "links": [
        {
          "rel": "context",
          "href": "https://api.bronto.io/context?sequence=111721913&limit=1&from=23746675-7022-4985-bd74-4af9eba58d72&timestamp=1711535140632&direction=both"
        }
      ]
    }
  ],
  "groups": [
    {
      "group": "[US]",
      "count": 124,
      "stat": "average(bytes)",
      "value": 50325.25,
      "timeseries": [
        {
          "@timestamp": "1711535140632",
          "count": 40,
          "value": 35.625,
          "quantiles": {
            "min": 691,
            "p25": 713.75,
            "p50": 796,
            "p75": 847.5,
            "p90": 1237,
            "p95": 1331,
            "p99": 1331,
            "p999": 1331,
            "max": 1331
          }
        }
      ]
    }
  ],
  "groups_series": [
    {
      "name": "host123",
      "count": 124,
      "stat": "average(duration_millis)",
      "value": 50325.25,
      "quantiles": {
        "min": 691,
        "p25": 713.75,
        "p50": 796,
        "p75": 847.5,
        "p90": 1237,
        "p95": 1331,
        "p99": 1331,
        "p999": 1331,
        "max": 1331
      },
      "series_resolution_ms": 60000,
      "timeseries": [
        {
          "@timestamp": "1711535140632",
          "count": 40,
          "value": 35.625,
          "quantiles": {
            "min": 691,
            "p25": 713.75,
            "p50": 796,
            "p75": 847.5,
            "p90": 1237,
            "p95": 1331,
            "p99": 1331,
            "p999": 1331,
            "max": 1331
          }
        }
      ],
      "groups_series": [
        {
          "name": "host123",
          "count": 124,
          "stat": "average(duration_millis)",
          "value": 50325.25,
          "series_resolution_ms": 60000,
          "timeseries": [
            {
              "@timestamp": "1711535140632",
              "count": 40,
              "value": 35.625,
              "quantiles": {
                "min": 691,
                "p25": 713.75,
                "p50": 796,
                "p75": 847.5,
                "p90": 1237,
                "p95": 1331,
                "p99": 1331,
                "p999": 1331,
                "max": 1331
              }
            }
          ]
        }
      ]
    }
  ],
  "metadata": {
    "select": [
      "host",
      "status",
      "method"
    ],
    "correlation_id": "00000000-0000-0000-0000-000000000000"
  },
  "totals": {},
  "pagination": {
    "next_page_url": "<string>"
  },
  "links": [
    {
      "rel": "next",
      "href": "<string>"
    }
  ]
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

{
  "code": 201,
  "correlation_id": "<string>",
  "message": "<string>"
}

Authorizations

X-BRONTO-API-KEY

string

header

required

Body

application/json

select

string[]

required

The select parameter enables the selection of one or many rows or columns from your datasets. It can be used to select keys by name, e.g. "select": ["ip_address", "status_code"], in which case the response will contain a list of log events with two columns containing ip addresses and status codes. Or it can be used with an aggregate function (count, max, min, avg, sum), e.g., "select": ["avg(response_time_ms)", "max(response_time_ms)"], in which case the response will contain columns for the average response time, and max response time. Each row corresponds to a time slice, for example if you set "num_of_slices": 10 and "time_range": "Last 10 hours", then each row will contain the function result for each hour of data. The @raw internal attribute is always available for selection, and its values are the entire unparsed log events.

Example:

[
  "min(response_time_ms)",
  "avg(response_time_ms)",
  "max(response_time_ms)"
]

from

string[]

The ids of the logs to search. One of either the from or the from_tags parameters must be specified.

from_tags

string[]

The tags to search. Each tag should be in the form <key>:<value>, e.g., environment:production. One of either the from or the from_tags parameters must be specified. If both are specified then from_tags takes precedence, and the from value is ignored. If the key or the value contain a : or = character, then these can be escaped by wrapping the entire key or value in double-quotes ".

time_range

string

The relative time range for which to query data. Time range supported is from milliseconds to years. For an exact range, use from_ts and to_ts instead.

Example:

"Last 10 minutes"

from_ts

integer

The starting time (unix time in milliseconds) for which to query data. Must be used together with to_ts. This parameter is incompatible with time_range.

Example:

1709251200000

to_ts

integer

The ending time (unix time in milliseconds) for which to query data. Must be used together with from_ts. This parameter is incompatible with time_range.

Example:

1711390455601

where

string

The where parameter is used to filter the results of your query. See https://docs.bronto.io/core-features/log-search/query-syntax for more details The filter can combine multiple terms using AND, OR, NOT.

Example:

"ip='10.0.0.1'"

groups

string[]

The groups parameter specifies a key to use to arrange the results returned by an aggregate function, (such as count, max, min, avg, sum) into groups of values. The aggregate function returns a single value for each group.

limit

integer

default:100

The maximum number of events that an event search should return. In a query with a group by, it limits the number of groups returned. It does not affect a query using aggregate functions.

Required range: 1 <= x <= 6666

Example:

50

num_of_slices

integer

default:10

The number of buckets to break the time series results into.

Example:

50

from_sequence

integer

Specifies the starting sequence number for the time range when used together with the from_ts parameter. Each log event has a sequence number which is unique within a millisecond, and can be used to query data with sub-millisecond time range precision. The sequence numbers are ordered such that earlier log events have lower sequence numbers.

Example:

111721913

most_recent_first

boolean

Flag to indicate the order in which results should be returned.

Example:

true

explain_only

boolean

default:false

If set to true then only the explain element of the response will be populated. The explain element will contain the Approximate bytes in time range attribute which provides an estimate for the amount of data present in the time range for the selected datasets.

Example:

true

async_enabled

boolean

default:false

If set to true the server will respond in an asynchronous way: it will return immediately with a polling link (in the links element of the response body), which the client should check periodically to monitor the progress of the query and to receive partial results. This is useful for long running queries, and allows an API client to handle multiple requests concurrently without blocking. The behaviour of the async API is described here.

If set to false the server will wait until the query has completed before returning a single 200 response with the completed results in the response body.

Response

Search results

explain

object

Show child attributes

result

object[]

Show child attributes

events

object[]

Show child attributes

groups

object[]

Show child attributes

groups_series

object[]

Show child attributes

metadata

object

Show child attributes

totals

object

pagination

object

Show child attributes

links

object[]

Option 1
Option 2

Show child attributes

API overview

api-keys

users

groups

search

context

live-tail

logs

datasets

monitors

dashboards

collections

access

downtimes

events

forward

roles

top-keys

widgets

integrations

exports

customers

tags

limits

permissions

ai

policies

encryption-keys

metrics

timeseries

patterns

Execute a query

Authorizations

Body

Response