TrueWatch log download service

简体中文

HTTP service for scripted log export: GET /logs?service=… returns log rows in [now − 24h − 5m, now − 5m] (server clock). Use curl or wget. Deploy on a private network; use INTERNAL_BEARER_TOKEN and Authorization: Bearer when exposing beyond trusted clients.

Run (Docker)

cp .env.example .env
# Edit .env: set TRUEWATCH_API_KEY (see .env.example for optional variables).
docker compose up --build

curl -fsS "http://127.0.0.1:8080/health"

# All log indexes (lists indexes via OpenAPI, then multi-index DQL):
curl -fsS "http://127.0.0.1:8080/logs?service=my-service&log_index=*&format=ndjson" -o logs.ndjson

# Single index:
curl -fsS "http://127.0.0.1:8080/logs?service=my-service&log_index=my-index&format=ndjson" -o logs.ndjson

Query parameters

Parameter	Description
service	Required. Filters by the field in LOG_FILTER_FIELD (default service).
log_index	Optional; overrides LOG_INDEX. *: calls GET /api/v1/metric_info/log/indexes, builds L("a","b",…)::*, and queries every listed index. A concrete name uses L("name")::* only.
log_source	Optional; overrides LOG_SOURCE (datasource after ::; often *).
format	ndjson (default), json, or text. With json, the body includes dql and, when log_index is *, resolvedLogIndexes.

Configuration

See .env.example.

• LOG_INDEX: * lists indexes and runs multi-index DQL; otherwise one index name.
• LOG_DQL_TEMPLATE: If set, index listing is skipped; log_index=* still substitutes {index} with default.
• LOG_WINDOW_HOURS, TRUEWATCH_WORKSPACE_SCOPE, workspace UUID, TRUEWATCH_TARGET_REGION: as in .env.example.

Do not share API keys or commit a filled .env.

No rows: Check service vs logs, LOG_WINDOW_HOURS, and workspace/region. For log_index=*, an empty or failed index list produces no DQL. The OpenAPI list may not include every index type (see Guance log index list API).