Search around an event

{
  "pointer": { "ts": 1790000000000000, "fingerprint": null },
  "before": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1789999999500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  },
  "after": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1790000000500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  }
}

{
  "pointer": { "ts": 1790000000000000, "fingerprint": null },
  "before": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1789999999500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  },
  "after": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1790000000500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  }
}

POST /api/v1/query/search_around

Returns the events immediately before and after an event within a window of 24 hours on each side. Counts default to 50 and are limited to 1 through 1000. The call requires streams.query, or sys.telemetry.read for system telemetry. before holds the events with a timestamp at or before the pointer, newest first, so the event itself is the first row when it is stored. after holds the events that are later than the pointer, oldest first. A stream that does not exist returns an empty before and after instead of an error. Body

Field	Type	Required	Default
`event_timestamp_us`	integer	Yes
`stream`	string	Yes
`stream_type`	string	Yes
`event_fingerprint`	string	No	Echoed in `pointer`. The server does not use it to pick events.
`before`	integer	No	50
`after`	integer	No	50

{
  "pointer": { "ts": 1790000000000000, "fingerprint": null },
  "before": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1789999999500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  },
  "after": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1790000000500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  }
}

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration