> ## Documentation Index > Fetch the complete documentation index at: https://docs.bronto.io/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve usage metrics over time > Retrieves usage statistics for your organization over a specified time period. Usage metrics include data ingestion volumes, search query counts, and export activities. The results can be broken down into time slices and optionally compared against previous periods for trend analysis. ## OpenAPI ````yaml https://s3.eu-west-1.amazonaws.com/docs.brontobytes.io/redocusaurus/brontobytes.yaml get /usage openapi: 3.0.2 info: title: Bronto API license: name: Commercial version: 1.0.0 servers: - url: https://api.eu.bronto.io - url: https://api.us.bronto.io security: - ApiKeyAuth: [] - BearerAuth: [] tags: - name: api-keys description: > An Application Programming Interface (API) key is a unique identifier. The API Key must be provided as X-BRONTO-API-KEY in headers for the request to be authenticated and authorized by the API server according to the API Key's role. For further information about roles visit [our API Key docs] https://docs.bronto.io/manage/manage-api-keys - name: context description: > Context is a REST API resource that allows the retrieval of a specified number of log events (default of 100) around a log event of interest, e.g. when a number of log events were returned by a previous query and you then decide you want to see the 50 log events before one of those returned log events. Log events can be retrieved either before, after, or both before and after the specified log event. - name: exports description: > The Bronto Export API allows you to efficiently download large volumes of log data for further analysis. The data to be exported can be filtered by entering the search parameters \"from\", \"where\" and \"time_range\" as per a normal query in the \"search_details\" object. To export data the following steps are required: 1. Create an export using a POST request, which will return an \"export_id\", \"status\" and \"progress\". 2. Use the export id to get the status of the export task by sending a GET request, which will return \"status\" and \"progress\" with a value of percentage completed. When the export is completed, the \"status\" will be \"COMPLETE\" 3. Once the export task has completed you can download your data using curl (or similar) from the \"location\" URL returned in the GET response. - name: collections description: > Collections group datasets together. Each collection contains one or more datasets. - name: datasets description: > Datasets are a sequence of timestamped log events. Datasets can be searched to view events matching a filter or to perform statistical functions on matching events. - name: logs description: > Logs are a sequence of timestamped log events. Logs can be searched to view events matching a filter or to perform statistical functions on matching events. - name: search description: > The REST API for searching data uses queries based on a subset of SQL, with the syntax as per https://docs.bronto.io/query-syntax/overview - name: top-keys description: > Top-Keys is a REST API resource that allows you to easily retrieve the top keys for a specific log. - name: usage description: > Usage is a REST API resource that allows you to easily track your Bronto usage by retrieving usage data relating to data ingestion and amount of data searched, and allowing you to drill down for a specific dataset over a defined timeframe. - name: users description: > Users are given specific roles, where each role determines the user's permissions within the application. Those roles are as follows: - "Admin" role has permission for all actions on all entities in the application. - "Standard" role allows Read/Write and Delete actions on entities in non-sensitive areas of the application. - "ReadOnly" role allows only read actions and only on entities in non-sensitive areas of the application. - name: config_assistant description: > The Config Assistant APIs provide endpoints for creating or modifying observability agent configurations. - name: patterns description: > Patterns return the Pattern IDs, templates, and source log ID for all logs matching the given search criteria. paths: /usage: get: tags: - usage summary: Retrieve usage metrics over time description: > Retrieves usage statistics for your organization over a specified time period. Usage metrics include data ingestion volumes, search query counts, and export activities. The results can be broken down into time slices and optionally compared against previous periods for trend analysis. operationId: getUsage parameters: - name: time_range in: query description: The period to calculate the usage for. required: false schema: type: string example: Last 2 days - name: num_of_slices in: query description: > The num_of_slices parameter defines how the time range is divided into intervals. It is optional, and if not provided, a default value is applied. The default number of slices is 1 minute granularity for up to 12 hours time range and 20 minutes granularity for longer than 12 hours time range up to 720 slices. - default for 20 minutes time window: 20 slices - default for 12 hour time window: 720 slices - default for 1 day time window: 72 slices (1 slice per 20 minutes) - default for 10 days time window: 720 slices (1 slice per 20 minutes) - default for 30 days time window: 720 slices (max number of slices allowed) required: false schema: type: integer example: 10 - name: usage_type in: query description: The type of usage to query. schema: type: string enum: - ingestion - search - export - name: delta in: query description: > Enables calculation of the difference between the current and previous time range values. When set to true, the response includes a delta object with the computed difference and its relative change. Defaults to false. required: false schema: type: boolean example: true - name: delta_time_range in: query description: > The time period for which to query data for delta comparison. Either `delta_time_range` or both `delta_from_ts` and `delta_to_ts` can be provided if `delta` is enabled. If `delta_time_range` is provided, it will take precedence required: false schema: type: string example: Previous month - name: delta_from_ts in: query description: > The starting unix time in milliseconds for which to query data for delta comparison. Either `delta_time_range` or both `delta_from_ts` and `delta_to_ts` can be provided if `delta` is enabled. If `delta_time_range` is provided, it will take precedence. required: false schema: type: integer example: 1709251200000 - name: delta_to_ts in: query description: > The ending unix time in milliseconds for which to query data for delta comparison. Either `delta_time_range` or both `delta_from_ts` and `delta_to_ts` can be provided if `delta` is enabled. If `delta_time_range` is provided, it will take precedence. required: false schema: type: integer example: 1711390455601 responses: '200': description: Successfully retrieved usage metrics headers: RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' RateLimit-Reset: $ref: '#/components/headers/RateLimitReset' content: application/json: schema: $ref: '#/components/schemas/MetricItem' example: id: f0e1d2c3-b4a5-6789-0abc-def123456789#ingestion-org_usage name: ingestion_org_usage filter: >- event_type='log_usage' AND collection_name!='.usage' AND collection_name!='.audit-trail' stat: SUM key: bytes_total group_keys: [] logs: - '' from_tags: [] aux: {} total_count: 3790 total_value: 12961699 is_exact: true series: - '@time': Sun Mar 01 00:00:00 UTC 2026 '@timestamp': '1772323200000' count: '546' value: '1274155.0' quantiles: {} - '@time': Mon Mar 02 03:14:15 UTC 2026 '@timestamp': '1772421255737' count: '679' value: '2688361.0' quantiles: {} groups_series: [] delta: start_time: 0 end_time: 0 total_count: 0 total_value: 0 delta_value: 0 delta_factor: 0 '400': description: Bad Request - The time range or other parameters are invalid content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- Forbidden - The user does not have the privileges to view usage metrics content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Too Many Request - Fair usage limits exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal Server Error - An error occurred on the server side. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' default: description: Unexpected Error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: headers: RateLimitLimit: description: The request limit per time window. schema: type: integer example: 20 RateLimitRemaining: description: The number of requests left in the current time window. schema: type: integer example: 12 RateLimitReset: description: The number of seconds left in the current time window. schema: type: integer example: 13 schemas: MetricItem: required: - filter - id - key - name - series - stat - total_count - total_value type: object properties: id: type: string example: 550e8400-e29b-41d4-a716-446655440000#home#usage name: type: string example: Usage filter: type: string example: resource='search' stat: type: string example: p90 key: type: string example: duration_millis group_keys: type: array description: Keys used for grouping the metric results items: type: string logs: type: array example: - 41521f35-1b06-41f0-9cdc-9a938b5739d1 items: type: string format: uuid from_tags: maxItems: 50 minItems: 1 uniqueItems: true type: array description: > The tags filters for selecting the datasets. Each from_tags should be in the form `:`, e.g. `environment:production`. When multiple from_tags are provided, filters on the same tag key are evaluated with OR logic, while filters on tags with different keys are evaluated with AND logic (facet style search). e.g. [`environment:production`, `team:A`, `team:B`] will include all production datasets where the team tag is either B or A. One of either the `logs` or the `from_tags` parameters _must_ be specified. If _both_ are specified then `from_tags` takes precedence, and the `logs` value is ignored. example: - environment:production deprecated: true items: maxLength: 250 minLength: 1 type: string from_expr: type: string description: > Expression used to select a set of logs. The expression defines the criteria for which logs are included and is applied across all available logs to produce the input set. Supports logical operators (AND, OR), comparison operators (=, !=), and quoted string literals. example: >- log_id = '797655e0-bddd-4abe-97a4-e9e419a72baa' OR environment != 'production' aux: type: object description: Auxiliary data for the metric example: region: us-west-1 service: s3 total_count: type: integer example: 58351920 total_value: type: number example: 18911006109 total_quantiles: type: object description: > Statistical distribution of the metric values represented by key quantiles: - **min**: The minimum observed value. - **p25**: The 25th percentile (first quartile). - **p50**: The 50th percentile (median). - **p75**: The 75th percentile (third quartile). - **p90**: The 90th percentile. - **p95**: The 95th percentile. - **p99**: The 99th percentile. - **p999**: The 99.9th percentile, highlighting extreme outliers. - **max**: The maximum observed value. example: min: 691 p25: 713.75 p50: 796 p75: 847.5 p90: 1237 p95: 1331 p99: 1331 p999: 1331 max: 1331 aggregates: type: array items: required: - function type: object properties: function: type: string value: type: number is_exact: type: boolean description: true if the series result is exact, false if it is an approximation example: true series: type: array description: timeseries for non-group by queries items: $ref: '#/components/schemas/TimeSlice' groups_series: type: array description: timeseries for group by queries items: $ref: '#/components/schemas/GroupSeriesItem' delta: $ref: '#/components/schemas/MetricDelta' ErrorResponse: required: - code - correlation_id - details - type type: object properties: code: maximum: 599 minimum: 400 type: integer description: HTTP status code for the error response. format: int32 type: type: string description: >- HTTP reason phrase associated with the status code (e.g. "Not Found" for 404) example: Not Found correlation_id: type: string description: Unique identifier for the request, used for tracing and debugging. details: type: string description: Human-readable description of the error. example: Resource not found. description: Standard error response returned by the API when a request fails. example: bad_request_validation: summary: Bad Request - Validation Error description: Example error when request validation fails value: code: 400 type: Bad Request correlation_id: 95c6a974e3ab01209b6b0dfedb1b16c5 details: 'Validation failed: ''name'' field is required and cannot be empty' bad_request_invalid_type: summary: Bad Request - Invalid Metric Type description: Example error when an invalid metric type is provided value: code: 400 type: Bad Request correlation_id: 00d8a51bb2874f2583670317a4fb8db7 details: >- Invalid metric_type 'INVALID'. Must be one of: COUNTER, GAUGE, HISTOGRAM forbidden: summary: Forbidden Access description: Example error when user lacks required permissions value: code: 403 type: Forbidden correlation_id: 40276639de0f49d586e32edd8c4f6b34 details: >- Access denied. User does not have permission to create metric definition templates not_found: summary: Resource Not Found description: Example error when requested resource doesn't exist value: code: 404 type: Not Found correlation_id: 605f832bcfe44a1081441691c8d42253 details: >- Metric definition template with id '550e8400-e29b-41d4-a716-446655440000' not found rate_limit: summary: Rate Limit Exceeded description: Example error when API rate limit is exceeded value: code: 429 type: Too Many Requests correlation_id: 53909ed43c544531b7a555e295960437 details: >- Rate limit exceeded. Maximum 100 requests are allowed within a 5-minute window internal_server_error: summary: Internal Server Error description: Example error for unexpected server-side failures value: code: 500 type: Internal Server Error correlation_id: b129b8e0e66c41aa9541a30f67e38ce2 details: An unexpected error occurred while processing your request TimeSlice: required: - '@timestamp' - count - value type: object properties: '@timestamp': type: string description: Unix timestamp in milliseconds of the start of this time slice example: '1711535140632' count: type: integer description: Count of the group key in the given time slice format: int64 example: 40 value: type: number description: >- The value of the statistical function for that group in the given time slice format: double example: 35.625 quantiles: type: object description: > Statistical distribution of the group’s values within the time slice, represented by key quantiles: - **min**: The minimum observed value. - **p25**: The 25th percentile (first quartile). - **p50**: The 50th percentile (median). - **p75**: The 75th percentile (third quartile). - **p90**: The 90th percentile. - **p95**: The 95th percentile. - **p99**: The 99th percentile. - **p999**: The 99.9th percentile, highlighting extreme outliers. - **max**: The maximum observed value. example: min: 691 p25: 713.75 p50: 796 p75: 847.5 p90: 1237 p95: 1331 p99: 1331 p999: 1331 max: 1331 GroupSeriesItem: type: object properties: key: type: string description: The group by key of this series example: hostname name: type: string description: The group name associated with the timeseries example: host123 count: type: integer description: >- The number of times this group appeared in the logs/metrics across the timeseries format: int64 example: 124 stat: type: string description: The statistical function applied to the group example: average(duration_millis) value: type: number description: Overall value as result of the statistical function applied format: double example: 50325.25 quantiles: type: object description: > Statistical distribution of the group’s metric values shown through key quantiles: - **min**: The minimum observed value. - **p25**: The 25th percentile (first quartile). - **p50**: The 50th percentile (median). - **p75**: The 75th percentile (third quartile). - **p90**: The 90th percentile. - **p95**: The 95th percentile. - **p99**: The 99th percentile. - **p999**: The 99.9th percentile, highlighting extreme outliers. - **max**: The maximum observed value. example: min: 691 p25: 713.75 p50: 796 p75: 847.5 p90: 1237 p95: 1331 p99: 1331 p999: 1331 max: 1331 series_resolution_ms: type: number description: >- The resolution of the timeseries in milliseconds, so the length in milliseconds of a time slice format: int64 example: 60000 timeseries: type: array description: list of slices of this timeseries items: $ref: '#/components/schemas/TimeSlice' groups_series: type: array description: > The subgroups time series of the group. Provided only in case multiple group-by keys where specified in the query. Every object in this array is a group time series object with the same properties as the parent object (key, name, count, stat, timeseries etc). The groups series recursion repeats the number of group by keys specified in the query. items: type: object properties: name: type: string description: The group name example: host123 count: type: integer description: The number of times this group appeared in the logs format: int64 example: 124 stat: type: string description: The statistical function applied to the group example: average(duration_millis) value: type: number description: Overall value of the statistical function applied format: double example: 50325.25 series_resolution_ms: type: number description: The resolution of the timeseries in milliseconds format: int64 example: 60000 timeseries: type: array items: $ref: '#/components/schemas/TimeSlice' MetricDelta: type: object properties: start_time: type: integer description: The starting unix time in milliseconds of the previous period. end_time: type: integer description: The ending unix time in milliseconds of the previous period. aggregates: type: array description: Aggregated values for the comparison period. items: required: - function type: object properties: function: type: string description: the name of the function value: type: number description: the computed value over the delta period changes: type: array description: | Change between current and delta period aggregates. items: required: - function - value type: object properties: function: type: string description: the name of the function value: type: number description: Absolute difference. factor: type: number description: Relative delta. description: > Contains information about the change in the metric aggregations between the specified time range and the delta time range. If the delta time range is not specified, the delta is computed against the time range immediately preceding the requested one securitySchemes: ApiKeyAuth: type: apiKey name: X-BRONTO-API-KEY in: header BearerAuth: type: http scheme: bearer bearerFormat: JWT ````