> ## Documentation Index > Fetch the complete documentation index at: https://ravion-b90c0359-devin-1786379042-config-change-phases-docs.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Query in-cluster Loki log rows > Query rows from the in-cluster Loki behind each selected loki ui.logs source, through the Operator agent. POST /logs/eks-loki in the Ravion API reference. ## OpenAPI ````yaml https://api.ravion.com/openapi.yaml post /logs/eks-loki openapi: 3.0.0 info: title: Ravion version: 0.0.0 servers: - url: https://api.ravion.com security: - BearerAuth: [] tags: - name: Projects - name: Environments - name: FeatureFlags - name: Pipelines - name: PipelineRuns - name: TerraformResources - name: TerraformExecutionSummaries - name: PipelineStepExecutions - name: AwsCloudWatch - name: PipelineVersions - name: Organizations - name: Stacks - name: StackWorkspaces - name: Auth - name: OAuth - name: User - name: Health - name: Memberships - name: ServiceAccounts - name: AwsDefaultNetworks - name: AwsAccounts - name: ApiKeys - name: AwsAmp - name: EksPrometheus - name: EksLoki - name: ExecutionEnvironments - name: ModuleDefinitions - name: ModuleCategories - name: ModuleVersions - name: ModuleInstances - name: DefaultValueDefinitions - name: DefaultValues - name: CodeSources - name: Github - name: Gitlab - name: Git - name: Values - name: Deployments - name: DeploymentResources - name: InfrastructureEvents - name: WebSocket - name: Domains - name: AcmCertificates - name: Describe - name: Reports - name: BillingPlans - name: BillingAccounts - name: BillingCycles - name: BillingUsageSummaries - name: BillingAddOns - name: BillingInvoices paths: /logs/eks-loki: post: tags: - EksLoki summary: Query in-cluster Loki log rows description: >- Query rows from the in-cluster Loki behind each selected `loki` ui.logs source, through the Operator agent. POST rather than GET because the filter is a recursive model that cannot ride query params, exactly as with the CloudWatch row query. operationId: GetEksLokiLogs requestBody: content: application/json: schema: $ref: '#/components/schemas/EksLokiLogsRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/EksLokiLogsResponse' description: The request has succeeded. '400': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: The request is invalid or malformed. '404': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: The server cannot find the requested resource. '422': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: Client error '500': content: application/json: schema: $ref: '#/components/schemas/Errors.UserFacingErrorData' description: Server error components: schemas: EksLokiLogsRequest: additionalProperties: false description: >- Request body for the Loki row query. Scope is resolved from whichever selector is provided — `environmentId`, `moduleInstanceIds`, `logSourceKeys`, or `deploymentResourceId` (one EKS workload) — exactly as the CloudWatch row query resolves its own. At least one is required. Only `loki` ui.logs sources are considered; CloudWatch sources in the same selection are ignored here and served by the CloudWatch endpoint, which is what lets a caller fan a single selection out across both. properties: deploymentResourceId: description: >- Scope to one EKS workload deployment resource. The server builds the LogQL selector from the workload's recorded namespace and name, so a caller never states a selector of its own. Must not be combined with `environmentId`, `moduleInstanceIds`, `logSourceKeys`, or `moduleDeploymentId`. nullable: true type: string endTime: description: Inclusive end of the query window (ISO 8601). type: string environmentId: description: >- Environment whose module-instance ui.logs sources are queried. Optional when `moduleInstanceIds`/`logSourceKeys` already name the sources. nullable: true type: string filter: allOf: - $ref: '#/components/schemas/CloudWatchLogFilter' description: >- Structured filter predicate tree, compiled to LogQL server-side. Omit (or send `{kind:"all"}`) for no filter. Predicates LogQL cannot represent are dropped and reported in `unsupported`. limit: description: >- Max rows to return (default 1000, max 5000). Loki's own `limit` is applied per query and the result is the most recent rows in the window; page further back by re-querying with `nextEndTimeMs` as `endTime`. format: int32 nullable: true type: integer logSourceKeys: description: >- Restrict to these individual ui.logs sources by composite `::` key. items: type: string nullable: true type: array moduleDeploymentId: description: >- Scope to one EKS module deployment's own log: the output of the Operator executor that applied it, collected into the cluster's Loki. The server builds the selector from the deployment id and resolves the cluster from the deployment. Must not be combined with any other selector. Empty for deployments the EC2 runner applied, whose log is in CloudWatch. nullable: true type: string moduleInstanceIds: description: Restrict to these module instance ids. items: type: string nullable: true type: array pod: description: >- With `deploymentResourceId`: show only this pod's lines. Must name a pod the workload currently reports (see the workload's `pods`); the pod name is structured metadata on the lines, never a stream label. nullable: true type: string startTime: description: Inclusive start of the query window (ISO 8601). type: string required: - startTime - endTime type: object EksLokiLogsResponse: additionalProperties: false description: >- Rows matching the query, plus what could not be answered. `offlineClusters` is the field that distinguishes this endpoint from its CloudWatch counterpart: a cluster whose Operator agent is not connected contributes no rows, and saying so by name is the difference between a user fixing their agent and a user believing their workload printed nothing. properties: missedSources: description: >- Composite `::` keys whose query failed for a reason other than an offline agent. items: type: string type: array nextEndTimeMs: description: >- Pass this as the next request's `endTime` to page further back. Zero when the window is exhausted. format: int64 type: integer offlineClusters: description: >- Cluster ARNs whose Operator agent is not connected. Render this as an explicit state, not as an empty result. items: type: string type: array partial: description: >- True when at least one source could not be queried, whether because its agent is offline or because its query failed. type: boolean resultCount: format: int32 type: integer rows: items: $ref: '#/components/schemas/EksLokiLogRow' type: array unsupported: description: >- Human-readable descriptions of filter predicates LogQL could not represent, so the UI can say which part of the query was dropped instead of silently widening it. items: type: string type: array required: - rows - nextEndTimeMs - partial - missedSources - offlineClusters - resultCount - unsupported type: object Errors.UserFacingErrorData: additionalProperties: false description: |- User-facing error presentation data. This is what the API returns to the frontend after formatting ErrorData using CEL templates from the error registry. Used for both: - Error fields on domain models (e.g., PipelineRun.error) - API error response bodies (HTTP 4xx/5xx responses) properties: action: allOf: - $ref: '#/components/schemas/Errors.Action' description: Optional action to help resolve the error code: description: Full error code, e.g., "Ravion:Pipeline:NOT_FOUND" type: string description: description: Additional description with more details type: string details: description: Structured details rendered as user-facing sections. items: $ref: '#/components/schemas/Errors.UserFacingErrorDetailSection' type: array isInternal: description: >- Indicates whether this error is internal (only set when ShowInternal=true). This allows SUPERADMINs to identify internal errors while viewing full details. type: boolean message: description: Main error message (required) type: string metadata: additionalProperties: {} description: >- Error params/metadata. Stripped for internal errors unless superadmin. type: object requestId: description: Request ID for correlating errors with server logs. type: string required: - code - message type: object CloudWatchLogFilter: additionalProperties: false description: >- One node in the structured log-filter predicate tree. `kind` discriminates the node; the other fields are populated per kind. The empty filter is `{kind:"all"}`. This is the wire form of the LogSearch AST — the server translates it into the source's query language (CloudWatch Logs Insights today), so negation/OR/grouping are honored server-side rather than dropped on the client. properties: filter: allOf: - $ref: '#/components/schemas/CloudWatchLogFilter' description: Child predicate for a `not` node. filters: description: Child predicates for `and` / `or` nodes. items: $ref: '#/components/schemas/CloudWatchLogFilter' type: array kind: description: >- Node kind: `all` (match everything) | `and` | `or` | `not` | `field` | `text`. type: string operator: description: >- Match operator for a `field` node: `eq` | `neq` | `contains` | `regex` | `gt` | `gte` | `lt` | `lte`. (Named `operator`, not `op`, because `op` is a TypeSpec keyword.) type: string path: description: >- Field path for a `field` node. The well-known paths `level` and `stream` route to dedicated channels (classified level / `@logStream`); any other path matches a JSON key:value fragment in `@message`. type: string value: description: >- Literal value for a `field` or `text` node. Shipped RAW — the server does all escaping. type: string required: - kind type: object EksLokiLogRow: additionalProperties: false description: >- A single log line from an in-cluster Loki. Field-for-field parallel to `CloudWatchLogInsightsRow` so a client merging both sources into one table has one row shape to render, with `stream` carrying the LogQL stream identity rather than a CloudWatch log-stream name. properties: eventId: description: Stable identifier for de-duplication across overlapping pages. type: string level: description: >- Classified level: `debug` | `info` | `warn` | `error`. Taken from the `level` structured-metadata label the addons collector attaches when present, and otherwise classified from the line by the same rules the CloudWatch path uses — so the two sources agree about what an error is. type: string logSourceId: description: >- ui.logs source id within that instance. Empty for rows matched through `deploymentResourceId`. type: string message: description: The log line as the workload printed it. type: string sourceId: description: >- Module instance the matched ui.logs source belongs to. Empty for rows matched through `deploymentResourceId`. type: string stream: description: >- Human-readable identity of the Loki stream the line came from, rendered from its labels (e.g. `production/api`). Fills the same column as CloudWatch's `logStream`. type: string timestamp: description: Line timestamp, epoch milliseconds. format: int64 type: integer required: - timestamp - message - stream - sourceId - logSourceId - level type: object Errors.Action: additionalProperties: false description: Action to help user resolve the error properties: label: description: Button/link label text type: string url: description: URL to navigate to for resolution type: string required: - label - url type: object Errors.UserFacingErrorDetailSection: additionalProperties: false description: Structured user-facing error detail section. properties: items: description: List of detail values for this section. items: type: string type: array object: additionalProperties: {} description: Structured detail payload for object rendering. type: object render: description: Rendering hint for clients. Valid values are list or object. type: string title: description: Detail section title shown in the UI. type: string required: - title - render type: object securitySchemes: BearerAuth: scheme: Bearer type: http ````