Skip to main content

qryn API

The qryn API is polyglot and supports many routes and formats to make it easy for your to use existing agents and log routes. Generally, qryn uses 3 distinct datatypes, supporting many input and output formats for each.

  1. logs (logfmt, json, syslog, text, elastic, datadog)
  2. traces (zipkin, tempo, otlp)
  3. metrics (prometheus, influx write)

For additional information about supported Endpoints, please also go here

Writing data

The following ingoing routes exist with each dataformat expressed as a JSON structure:

API EndpointDataformat TypeDescription
/loki/api/v1/pushLogql FormatIntended for String Logs
/{{target}}/_docJSON ObjectIntended for JSON object, {{target}} to be replaced with a label e.g. app_logs
/api/v2/logsDatadog FormatTo receive datadog agent logs
/influx/api/v2/writeInflux FormatUse this with influx-compatible senders
/tempo/api/pushTempo Format SpansSend Tempo compatible trace spans to this endpoint
/api/v2/spansZipkin Format SpansSend Zipkin compatible trace spans to this endpoint
/v1/tracesOTLP Format SpansSend OTLP compatible spans to this endpoint

LogQL Format

The simplest format to use when using something like vector or grafana agents to cover log observability or if used from code to send logs directly to the API.

Send as stringified JSON as the body of the POST request:

streams: [
stream: {
label: 'labelValue',
numericalLabel: '1'
values: [
[( * 1000000).toString(), 'example=logfmt key=value']

Labels will be indexed and logs are searchable through them, whilst the values array is not indexed. The timestamp is a string in nanoseconds.

JSON Objects Format

The Elastic API simply expect a stringified JSON Object inside the body of the POST request. The :target is used to set the label.

Datadog Format

The datadog API supports receiving the Datadog Agent format.

Additional Formats

qryn is polyglot to bring together many different agent and producers. Please refer to their documentation for these formats. If you see a format that you would want to use, but is not present in this documentation, please ping support to let us know.

Reading data

Use compatible clients to read each of the respective APIs or consume the data directly.

Usually you will want to use label retrieval calls to see available labels in your data, then use logql / promql queries to retrieve data inside those labels.

API EndpointTypeDescription
/loki/api/v1/label?start=millisecondTimestamp&end=millisecondTimestamplogqlReceive a list of labels between start and end timestamp
/loki/api/v1/query_range?query={label="value"}&start=milliseconds&end=millisecondslogqlReceive the result of the specified query
/api/v1/labels?start=millisecondTimestamp&end=millisecondTimestamppromqlReceive a list of labels between start and end timestamp
/api/v1/label/{{label_name}}/values?start=millisecondTimestamp&end=millisecondTimestamppromqlReceive the values of a specific {{label}} to use for queries
/api/v1/query_range?query=query_string{valid="promQlQuery"}&start=millisecondTimestamp&end=millisecondTimestamppromqlReceive the result of the specified query