FuseQL API for Logs

To interact programmatically with FuseQL logs, you must issue the required query requests.

The FuseQL query is embedded within the GraphQL request arguments. FuseQL works with tables, so the result of the FuseQL query is often a table that follows a schema defined by the column headers.

Embed the supported FuseQL query within the graphQL request arguments. See instructions on how to use GraphQL.

For authorization, see Authorization for API calls.

Supported queries

getLogMetricsResultWithKfuseQl: Get a time series of metrics derived from logs for the specified time range using native Kloudfuse query engine.
getLogsWithFuseQlStream: Get logs for the specified time range, using the native Kloudfuse query engine.

For additional log APIs, see API for Logs.

Prerequisites

Configure a GraphQL client. See GraphQL documentation.
Authenticate using the basic HTTP authentication protocol.

getLogMetricsResultWithKfuseQl

Get a time series of metrics derived from logs for the specified time range using native Kloudfuse query engine.

Syntax

{ (1)
  getLogMetricsResultWithKfuseQl(
    query: String! (2)
    startTs: Time! (3)
    endTs: Time! (4)
    timeoutSecs: Int (5)
    options: String (6)
  ): FuseQLQueryResult (7)
}

1	This is a query; calls return a single response.
2	`query`: Query of logs, including all operators.
3	`startTS`: Start timestamp of a query; should be less than `endTs` because it must be earlier.
4	`endTS`: End timestamp of a query; should be more than `endTs` because it must be later.
5	`timeoutSecs`: Optional query timeout, in seconds; default is 60 seconds.
6	`options`: Query options; string of comma-separated `k=v` key-value pairs. Not implemented — DO NOT USE.
7	`FuseQLQueryResult` Returns the following: `AggrValues` (list of aggregation column headers) `ColumnHeaders` (list of column names in the FuseQL result) `GroupKeys` (list of groups by column headers) `TimeKey` (time bucket column heade)r `TableResult` (rows returned from the FuseQL query) `UrlValues` (list of URL column headers)

Examples

Initial query

{
  getLogMetricsResultWithKfuseQl(
    query: "* | timeslice 5s | count by (_timeslice)"
    startTs: "2025-04-09T12:04:50-07:00"
    endTs: "2025-04-09T12:09:50-07:00"
  ) {
    AggrValues
    ColumnHeaders
    GroupKeys
    TimeKey
    TableResult
    UrlValues
  }
}

getLogsWithFuseQlStream

Get logs for the specified time range, using the native Kloudfuse query engine.

This API is relatively limited. By default, the system sorts the results by timestamp, in descending order, and retrieves up to 200 results. You must use a looping mechanism to retrieve all results, until the end of read.

Syntax

subscription { (1)
  getLogsWithFuseQlStream(
    query: String! (2)
    startTs: Time! (3)
    endTs: Time! (4)
    cursor: String (5)
    timeoutSecs: Int (6)
    options: String (7)
  ): FuseQLQueryResult (8)
}

1	`subsription`: This is a subscription; calls return multiple responses.
2	`query`: Query of logs, including all operators, *except* Window and Aggregation.
3	`startTS`: Start timestamp of a query; should be less than `endTs` because it must be earlier.
4	`endTS`: End timestamp of a query; should be more than `endTs` because it must be later.
5	`cursor`: Pagination cursor. It must be `null` for the first GraphQL query; subsequent queries must include values from the previous response. If the returned cursor is empty, there are no more results left to fetch.
6	`timeoutSecs`: Optional query timeout, in seconds; default is 60 seconds.
7	`options`: Query options; string of comma-separated `k=v` key-value pairs. Not implemented — DO NOT USE.
8	`FuseQLQueryResult`: Returns the following: `TableResult` (rows returned from the FuseQL query) `ColumnHeaders` (list of column names in the FuseQL result) `Cursor` (opaque cursor returned to help in pagination; empty string when no more data to fetch).

Examples

Initial query

    subscription {
      getLogsWithFuseQlStream(
        cursor: null,
        query: "source=\"kfuseprofiler\"",
        startTs:  "2025-04-04T09:00:00-07:00",
        endTs: "2025-04-04T10:00:00-07:00",
      ) {
        TableResult
        ColumnHeaders
        Cursor
      }
    }

Response

{
  "data": {
    "getLogsWithFuseQlStream": {
      "ColumnHeaders": [
        "timestamp",
        "source",
        "logLine",
        "fpString",
        "fpHash",
        "level",
        "labels",
        "facets"
      ],
      "TableResult": [
        [
          1743783475585,
          "kfuseprofiler",
          "[DEBUG] content type: multipart/form-data; boundary=dc38d23cb110dc72e94dbc64fef4f7591041ebc99b5bd5c83c4f55d10d5b",
           .
           .
           .
        ]
      ],
      "Cursor": "eyJzb3J0QnlWYWwiOiIxNzQzNzgyNzU1NTM5Iiwib2Zmc2V0IjoyfQ=="
    }
  }
}

Next query

    subscription {
      getLogsWithFuseQlStream(
        cursor: "eyJzb3J0QnlWYWwiOiIxNzQzNzgyNzU1NTM5Iiwib2Zmc2V0IjoyfQ==",
        query: "source=\"kfuseprofiler\"",
        startTs:  "2025-04-04T09:00:00-07:00",
        endTs: "2025-04-04T10:00:00-07:00",
      ) {
        TableResult
        ColumnHeaders
        Cursor
      }
    }