--- title: Log Timeseries summary: >- The Observability Timeseries API for Logs allows users to query the sampled logs that are collected for the Log Explorer & Insights product as time series data with user-defined aggregations and filters. url: >- https://www.fastly.com/documentation/reference/api/observability/timeseries/logs --- The Observability Timeseries API for Logs allows users to query the sampled logs that are collected for the Log Explorer & Insights product as time series data with user-defined aggregations and filters. ## Data model | Field | Type | Description | |-------|------|-------------| | `client_as_number` | integer | The autonomous system (AS) number of the client. (Read-only) | | `client_browser_name` | string | The name of the browser in use on the client device. (Read-only) | | `client_browser_version` | string | The version of the browser in use on client device. (Read-only) | | `client_country_code` | string | The two-letter ISO 3166-1 country code for the client. (Read-only) | | `client_device_type` | string | The type of the client's device. (Read-only) | | `client_os_name` | string | The name of the operating system installed on the client device. (Read-only) | | `client_region` | string | The client's country subdivision code as found in ISO 3166-2. (Read-only) | | `fastly_pop` | string | The name of the Fastly POP that served this request. (Read-only) | | `is_cache_hit` | boolean | Indicates whether this request was fulfilled from cache. (Read-only) | | `is_edge` | boolean | Indicates whether the request was handled by a Fastly edge POP. (Read-only) | | `is_shield` | boolean | Indicates whether the request was handled by a Fastly shield POP. (Read-only) | | `origin_host` | string | The name of the origin host that served this request. (Read-only) | | `request_host` | string | The name of the request host used for this request. (Read-only) | | `request_method` | string | HTTP method sent by the client such as "GET" or "POST". (Read-only) | | `request_path` | string | The URL path supplied for this request. (Read-only) | | `request_protocol` | string | HTTP protocol version in use for this request. For example, HTTP/1.1. (Read-only) | | `response_bytes_body` | integer | Body bytes sent to the client in the response. (Read-only) | | `response_bytes_header` | integer | Header bytes sent to the client in the response. (Read-only) | | `response_content_length` | integer | Total bytes sent to the client in the response. (Read-only) | | `response_content_type` | string | The content type of the response sent to the client. (Read-only) | | `response_reason` | string | The HTTP reason phrase returned for this request, if any. (Read-only) | | `response_state` | string | The state of the request with optional suffixes describing special cases. (Read-only) | | `response_status` | integer | The HTTP response code returned for this request. (Read-only) | | `response_time` | number | The time since the request started in seconds. (Read-only) | | `response_x_cache` | string | Indicates whether the request was a HIT or a MISS. (Read-only) | ## Data model | Field | Type | Description | |-------|------|-------------| | `field` | string | The field this filter applies to. | | `operator` | string | The comparison operator used for this filter. | | `value` | object | The comparison value used for this filter. Can be string, number, boolean, string array, or number array. | ## Data model | Field | Type | Description | |-------|------|-------------| | `field_filters` | array | Array of filter objects describing filters supplied in the request. | | `from` | string | Start time for the query as supplied in the request. | | `granularity` | string | The granularity of the time buckets in the response. | | `limit` | string | Maximum number of results returned in the request. | | `service_id` | string | ID of the service for which data was returned. | | `to` | string | End time for the query as supplied in the request. | ## API endpoints ### Retrieve log data as time series **GET** `/observability/timeseries` Retrieves log data as time series. **Parameters:** | Name | Type | In | Required | Description | |------|------|----|---------|--------------| | `filter` | string | query | No | Filter parameters take the form filter[<field>][<op>]=<value>. For example, filter[response_time][gte]=0.5 would filter for logs where the response time was greater than or equal to 0.5 seconds. Multiple filter expressions can be combined. The filters will be combined with a logical AND operator so that the logs returned match all supplied filters. Supported filter fields include domain, request_path, fastly_pop, response_time, response_status, fastly_is_shield, fastly_is_edge, client_os_name, client_device_type, client_browser_name, and fastly_is_cache_hit. Supported filter operators include = (applicable to string, numeric, and boolean values), ends-with (applicable to string values), in (applicable to lists of string and numeric values), not_in (applicable to lists of string and numeric values), and gt, gte, lt, lte (applicable to numeric values). | | `from` | string | query | Yes | Specifies the inclusive start time of the data to be queried. Must be in valid RFC 3339 format. | | `granularity` | string | query | Yes | The duration of each interval in the time series. | | `limit` | string | query | No | Maximum number of results to return. | | `series` | string | query | Yes | Comma-separated list of the data series to be computed for each time bucket. Series definitions take the form <function>[<field>]. For example, series=avg[response_time] will compute the average response time for each time bucket. At least one series is required. | | `service_id` | string | query | Yes | Specifies the ID of the service for which data should be returned. | | `source` | string | query | Yes | Specifies the source of the data for the time series. Must be logs to retrieve log data. | | `to` | string | query | Yes | Specifies the exclusive end time of the data to be queried. Must be in valid RFC 3339 format. |