streams.query, or sys.telemetry.read in the system scope.
The body is any JSON value up to 1 MiB (1,048,576 bytes). The document belongs to the organization of the caller. The compactor removes it after 7 days.
curl -X POST http://localhost:5080/api/v1/web/investigation/blob \
-H "authorization: Bearer $MS_JWT" \
-H 'content-type: application/json' \
-d '{
"version": 1,
"stack": [
{ "kind": "trace", "trace_id": "0af7651916cd43dd8448eb211c80319c" },
{ "kind": "log", "query": "level = error" }
]
}'
{
"blob_id": "3KEZAC5JXc0P0HjrTdARfCgH1Y3"
}
Correlation & Web
Store investigation stack
Persist the state of an investigation under a short identifier.
curl -X POST http://localhost:5080/api/v1/web/investigation/blob \
-H "authorization: Bearer $MS_JWT" \
-H 'content-type: application/json' \
-d '{
"version": 1,
"stack": [
{ "kind": "trace", "trace_id": "0af7651916cd43dd8448eb211c80319c" },
{ "kind": "log", "query": "level = error" }
]
}'
{
"blob_id": "3KEZAC5JXc0P0HjrTdARfCgH1Y3"
}
Last modified on October 9, 2026