Streamed query

NOW=$(date +%s)000000

curl -G http://localhost:5080/api/v1/query/stream \
  -H "authorization: Bearer $MS_JWT" \
  --data-urlencode "sql=SELECT level, msg FROM app ORDER BY _timestamp DESC" \
  --data-urlencode "stream=app" \
  --data-urlencode "stream_type=logs" \
  --data-urlencode "from=$((NOW-3600000000))" \
  --data-urlencode "to=$((NOW+60000000))" \
  --data-urlencode "limit=3"

{"level":"info","msg":"fine"}
{"level":"error","msg":"db pool exhausted"}
{"__meta__":{"scanned_rows":5,"took_ms":173}}

NOW=$(date +%s)000000

curl -G http://localhost:5080/api/v1/query/stream \
  -H "authorization: Bearer $MS_JWT" \
  --data-urlencode "sql=SELECT level, msg FROM app ORDER BY _timestamp DESC" \
  --data-urlencode "stream=app" \
  --data-urlencode "stream_type=logs" \
  --data-urlencode "from=$((NOW-3600000000))" \
  --data-urlencode "to=$((NOW+60000000))" \
  --data-urlencode "limit=3"

{"level":"info","msg":"fine"}
{"level":"error","msg":"db pool exhausted"}
{"__meta__":{"scanned_rows":5,"took_ms":173}}

GET  /api/v1/query/stream
POST /api/v1/query/stream

Always answers with chunked NDJSON (application/x-ndjson). Each line is a JSON object keyed by column name, and the final line is {"__meta__":{"scanned_rows":...,"took_ms":...}}. The endpoint never turns a query into an asynchronous job. The call requires streams.query, or sys.telemetry.read in the system scope. The POST form takes the same body as Execute a query. The GET form takes query parameters:

Param	Required	Notes
`sql`	Yes	The statement. A missing value answers `400`.
`stream`	Yes	The primary stream name.
`stream_type`	Yes	`logs`, `metrics`, `traces`, `profiles`, or `extend`.
`from`, `to`	Yes	Time range in microseconds.
`limit`	No	Row cap.

NOW=$(date +%s)000000

curl -G http://localhost:5080/api/v1/query/stream \
  -H "authorization: Bearer $MS_JWT" \
  --data-urlencode "sql=SELECT level, msg FROM app ORDER BY _timestamp DESC" \
  --data-urlencode "stream=app" \
  --data-urlencode "stream_type=logs" \
  --data-urlencode "from=$((NOW-3600000000))" \
  --data-urlencode "to=$((NOW+60000000))" \
  --data-urlencode "limit=3"

{"level":"info","msg":"fine"}
{"level":"error","msg":"db pool exhausted"}
{"__meta__":{"scanned_rows":5,"took_ms":173}}

Disable response buffering at the proxy (proxy_buffering off) so rows arrive as they are produced, and allow long reads. Stop reading to cancel the stream.

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration