Logs
Log lines from your apps, kept beside their errors and searched with one box.
What it is
Lines come from the StatOSS and Sentry SDKs, OpenTelemetry, the Vercel, Fly, Cloudflare and Heroku drains, and plain JSON, each with an app's key. Send logs has each way in.
Logs, in the dashboard, shows the lines newest first with their time, level, service and body, a chart of their volume by level above them, and facets beside them: level, service, environment and the commonest attributes with their top values. A line opens to its JSON, the 25 lines either side of it from the same app and service, and the issues of its trace. An issue shows the logs of its latest event's trace, or the app's lines in the five minutes before it.
Each line has a time, a level (OpenTelemetry's severity, 1 to 24, or one of the app's own levels), a body, a service, an environment, a release, a trace and span id, and attributes, nested ones flattened with dots. Passwords, tokens, cookies, keys and the like are stored as [Filtered].
Searching
The box takes the search language Issues and Explore take: Search language has every term. In Logs, words, phrases and /regex/ read the body; key:value reads an attribute, or the service:, env:, release:, source:, trace: and span: columns; key:/regex/ matches an attribute; level:error is OpenTelemetry's range, and pattern: a pattern by its number.
The same search finds the same lines in the dashboard, log alerts, the API and the MCP.
Live tail
Live tail adds new lines at the top every 2 seconds. It pauses while the list is scrolled away from the top or a line is open; "N new" goes on. From a terminal: statoss logs tail.
Patterns
A line's pattern is its body with numbers, hex, UUIDs, IP and email addresses and quoted strings written <*>. Patterns lists the range's patterns by count, each with a sample line. "Only this" keeps a pattern's lines, "Hide this" leaves them out.
Saved views
A saved view is a name for a search and its filters, kept for the team. Its link opens it: /app/logs?view=<id>. Issues and Explore have them too.
Alerts
An app's log alerts sit beside its issue alert rules: a search, one condition, and an on-call alert when it holds, routed and paged as issue alerts are.
| Condition | Holds with |
|---|---|
match | at least N lines in W minutes |
fewer | fewer than N lines in W minutes |
absent | no line in W minutes |
W is 1 to 1,440 minutes. An alert fires once the condition has held for C minutes (0 is at once) and resolves once it has been false for R minutes, each 0 to 60. Rules are checked once a minute. An alert carries up to five sample lines and a link to the search.
Limits and the daily cap
- Each team has a daily cap, 1 GiB unless an owner or admin sets another under Settings, Logs add-on. A line's size is its body plus its attribute keys and values. At the cap, lines are refused with 429 until midnight UTC, and Logs says so.
- Lines are kept 14 days, or 3, 7 or 30 as Settings, Logs add-on says.
- An app sends up to 60,000 lines a minute; past it, 429.
- A request is at most 8 MiB, before and after decompression; past it, 413. Lines past its first 5,000 are rejected.
- A body is cut at 64 KiB, with its size in bytes as
statoss.truncated. A line keeps 128 attributes, keys up to 128 characters, values up to 8 KiB.
A 429 or 503 carries Retry-After; the SDKs and the Collector wait and send again.
Price
Logs are an add-on to Hobby and Pro, switched on by the team's owner under Settings, Logs add-on. $5 a month with 15 GB, then $0.25 a GB. Lines kept 30 days count twice.
- A GB is 1,024³ bytes, counted as the daily cap counts them, in the subscription's billing period.
- The add-on and each whole GB past 15, at $0.25, are billed at the period's end. Settings, Logs add-on shows the period's count.
- Turned off, lines stop coming in, and stored ones age out.
API, MCP and CLI
GET /api/v1/logs searches with q, apps, environment, and range or from and to, newest first, a page at a time. GET /api/v1/logs/{id} gives a line with the lines around it, and /api/v1/logs/volume, /facets and /patterns the rest of the screen. Saved views are under /api/v1/views, log alerts under /api/v1/apps/{app}/log-alerts. A read key does for reading.
The MCP has search_logs, tail_logs, get_log, log_volume, log_facets, log_patterns, the views and the log alerts.
npx @statoss/cli logs tail 'level:>=warn service:api'
npx @statoss/cli logs search '"timed out"' --since 1h --limit 50The CLI reads STATOSS_API_KEY; tail polls every 2 seconds until Ctrl-C, and search reaches back 31 days at most.