---
title: "search"
slug: "effective-log-search-analytics-search"
updated: 2026-10-08T04:24:16Z
published: 2026-10-08T04:24:16Z
canonical: "api.ncloud-docs.com/effective-log-search-analytics-search"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# search

## Overview

You can look up Effective Log Search & Analytics logs by project.

## Request

### API URL

```
POST
https://elsa.apigw.ntruss.com/api/v1/logs/search
```

### Request headers

The request headers specified in common settings are required. [Go to the creation guide of NAVER Cloud Platform authentication key and signature](https://api.ncloud-docs.com/beta/docs/en/ko/common-ncpapi)

```
x-ncp-apigw-timestamp: {current timestamp}
x-ncp-iam-access-key: {your iam access key}
x-ncp-apigw-signature-v2: {generated signature}
```

### Request parameters

| Parameter name | Requirement status | Type | Restrictions | Description |
| --- | --- | --- | --- | --- |
| projectKey | Yes | string | 1-53 | Project key Example: “projectKey”:“Pbxxxxx_elsa-test” |
| projectId | Yes | int |  | Project ID Example: "projectId": 8171 |
| from | Yes | int |  | Timestamp to start the search (UTC millisecond) Example: "from": 1381190400000 |
| to | Yes | int |  | Timestamp to end the search (UTC millisecond) Example: "to": 1381190400000 |
| offset | No | int | offset+limit<=10000 | Default value: 0 You can specify an offset value at the beginning of the search results. 0 means it starts with the first record. Example: "offset": 100 |
| limit | No | int | 1 - 1000 | Default: 10 Specifies the number of logs to return for a request. Returns the specified number of logs based on the offset value. Example: "limit": 500 |
| sorts | No |  |  | Default: [{"logTime":"DESC"}] You can specify the sort criteria and method. Some aspects apply only when using the sorts feature. If the field to be sorted is a string-type field other than the specified fields (projectName, logTime, logLevel, host, projectVersion), you must append ".raw" to the field name. If you are unsure whether a field requiring sorting should have “.raw” appended, you can check via the /api/v1/fields API. Example: “sorts”: [{"logType.raw":"DESC"}] “sorts”: [{"projectVersion":"ASC"},{"logType.raw":"DESC"}] |
| query | No | string |  | Boolean operators AND OR NOT + - For more information on how to use these operators, see [Query String Syntax](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html) and [Lucene Query Syntax](https://lucene.apache.org/core/4_6_1/queryparser/org/apache/lucene/queryparser/classic/package-summary.html#Overview). JSON special characters. To search for JSON special characters like the ones below, use a \ before the character. " \ Example: Source: "query": "NOT logLevel:"FATAL" AND projectName:"elsa-test" AND (agent:"iPhone" OR agent:"iPod")" After escaping: "query": "NOT logLevel:\"FATAL\" AND projectName:\"elsa-test\" AND (agent:\"iPhone\" OR agent:\"iPod\")" |
| includeFields | No | [string] |  | This is a list of field names needed to query logs. Example: "includeFields": ["logSource", "logType","body"] |
| excludeFields | No | [string] |  | This is the list of field names that is not needed to look up logs. Example: “excludeFields”: [“DmpReport”,” logType”] |

### Request body

```
{
  "projectId": 8171,
  "projectKey": "Pbxxxxx_elsa-test",
  "from": 1381190400000,
  "to": 1381190400000,
  "offset": 0,
  "limit": 1000,
  "query": "NOT logLevel:\"FATAL\" AND projectName:\" elsa-test\" AND (agent:\"iPhone\" OR agent:\"iPod\")",
  "includeFields": [
    "logSource",
    "logType",
    "body"
  ],
  "sorts": [
    {
      "projectVersion": "ASC"
    },
    {
      "logType.raw": "DESC"
    }
  ]
}
```

### Request example

```
import hashlib
import hmac
import base64
import time
import requests

def make_signature(access_key, secret_key, timestamp, url):
    timestamp = str(timestamp)
    secret_key = bytes(secret_key, 'UTF-8')
    method = "POST"

    message = method + " " + url + "\n" + timestamp + "\n" + access_key
    message = bytes(message, 'UTF-8')
    signingKey = base64.b64encode(hmac.new(secret_key, message, digestmod=hashlib.sha256).digest())
    return signingKey.decode('UTF-8')

def log_search():
    baseurl = "https://elsa.apigw.ntruss.com" #{OpenAPI endpoint}
    url = "/api/v1/logs/search"

    access_key = "accessKey" #{Main / Sub Account Access Key}
    secret_key = "secretKey" #{Main / Sub Account Secret Key}
    timestamp = int(time.time() * 1000)

    signature = make_signature(access_key, secret_key, timestamp, url)
    url = baseurl + url

    payload = {
      "projectId": 8171,
      "projectKey": "Pbxxxxx_elsa-test",
      "from": 1381190400000,
      "to": 1381190400000,
      "offset": 0,
      "limit": 1000,
      "query": "NOT logLevel:\"FATAL\" AND projectName:\" elsa-test\" AND (agent:\"iPhone\" OR agent:\"iPod\")",
      "includeFields": ["logSource","logType","body"],
      "sorts":[{"projectVersion":"ASC"},{"logType.raw":"DESC"}]
    }

    headers = {
        "x-ncp-apigw-timestamp": str(timestamp),
        "x-ncp-iam-access-key": access_key,
        "x-ncp-apigw-signature-v2": str(signature)
    }

    response = requests.post(url=url,
                  json=payload,
                  verify=True,
                  headers=headers
                  )
```

## Response

### Response body

```
{
  "data": {
    "total": 2,
    "logs": [
      {
        "sort": [
          "9.9.9",
          "elsa-log"
        ],
        "id": "27mt7eQqk9xILgiLdJcgxxxx",
        "existDmp": false,
        "source": {
          "logType": "elsa-log",
          "logSource": "json",
          "body": "Hello, I am [ xxx ], Nice to meet you !"
        }
      },
      {
        "sort": [
          "9.9.9",
          "nelo2-log"
        ],
        "id": "55mt7eQqk9xILgiLdJcgxxxx",
        "existDmp": false,
        "source": {
          "logType": " elsa-log ",
          "logSource": "json",
          "body": "Hello, I am [ xxx ], Nice to meet you !"
        }
      }
    ]
  },
  "status": 200
}
```