Container logs: search, live tail, alerts and retention

Search every service's logs with field conditions, follow them live, get notified when an error repeats and keep logs up to a year.

# errors with HTTP 5xx in the last 2 hours (all services of the environment)
curl -s -G https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/logs -H "Authorization: Bearer $GYRO_TOKEN" \
  --data-urlencode "level=error" --data-urlencode "where=status>=500;path~/api" --data-urlencode "since_minutes=120"
# live tail: pass tail_cursor (then cursor) as "after" every 2-3 s
curl -s -G https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/logs -H "Authorization: Bearer $GYRO_TOKEN" --data-urlencode "after=$CURSOR"
# alert when "ERROR" shows up 20 times in 5 minutes
curl -s -X PUT https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/log-rules -H "Authorization: Bearer $GYRO_TOKEN" -H "Content-Type: application/json" \
  -d '{"rules":[{"name":"errors","pattern":"ERROR","threshold":20,"window_minutes":5,"enabled":true}]}'

gyro container logs 12345 api --where 'status>=500' --since 2h
gyro container logs 12345 -f
gyro container log-stats 12345 --by status
gyro container log-usage 12345
gyro container log-retention set 12345 --days 90 --gb 10 --yes

There is no raw query language: the platform builds every query with your environment fixed. Filters: filter (line contains, case-insensitive), exclude, level and where field conditions on JSON / logfmt lines (= != > >= < <= ~ contains). One query returns up to 5,000 lines and spans up to 31 days; next_cursor pages back.

Retention packages#

Free: 7 days, 5 GB of logs per month. Paid packages keep logs 30, 90 or 365 days with 10 / 50 / 100 / 300 GB per month (GET /cloud/containers/{id}/logs/plans, prices in TL and EUR), billed hourly from the prepaid balance; change or cancel any time. No overage bill: when the month's size is used up, the oldest logs are deleted earlier and you get the log_quota alert at 80 % and 100 %. Logs of a cancelled environment are deleted at once.