Create Saved Search

POST/api/v2/saved-searches

Creates a new saved search.

Authorizations

AuthorizationBearer API Keyheaderrequired
`Authorization: Bearer <token>`

Request bodyJSON

namestringrequired
Display name for the saved search.

maxLength: 1024
Example: "Production Errors"
sourceIdstringrequired
ID of the source to query. Must belong to the team.

Example: "507f1f77bcf86cd799439012"
selectoptionalstring
Comma-separated list of column expressions to display. Empty uses the source default.

maxLength: 4096
Example: "Timestamp, ServiceName, Body"
whereoptionalstring
Row filter expression. The language is controlled by whereLanguage.

maxLength: 8192
Example: "SeverityText:ERROR"
whereLanguageoptionalluceneorsql
Language used for the where filter.

Default: "lucene" · Example: "lucene"
orderByoptionalstring
ORDER BY expression. Empty uses the source default.

maxLength: 1024
Example: "Timestamp DESC"
tagsoptionalarray ofstring
Tags used to organize saved searches.

maxLength: 32
Example: ["production","errors"]
filtersoptionalarray ofobject
Structured pinned filters applied to the search.

Example: [{"type":"sql","condition":"ServiceName IN ('checkout', 'payments')"}]
2 properties
- conditionstringrequired
  SQL predicate applied to the search, in <column> IN (...) form.
  
  maxLength: 8192
  Example: "ServiceName IN ('checkout', 'payments')"
- typeoptionalsql
  Always sql. Only SQL predicate filters render in the sidebar.
  
  Default: "sql" · Example: "sql"

Response

JSON

200

Successfully created saved search

JSON

dataoptionalobject
The saved search object.
12 properties
- idstringrequired
  Unique saved search ID. Server-generated.
  
  Example: "507f1f77bcf86cd799439011"
- namestringrequired
  Display name for the saved search.
  
  Example: "Production Errors"
- sourceIdstringrequired
  ID of the source this saved search queries.
  
  Example: "507f1f77bcf86cd799439012"
- selectoptionalstring
  Comma-separated list of column expressions to display. Empty uses the source default.
  
  Example: "Timestamp, ServiceName, Body"
- whereoptionalstring
  Row filter expression. The language is controlled by whereLanguage.
  
  Example: "SeverityText:ERROR"
- whereLanguageoptionalluceneorsql
  Language used for the where filter.
  
  Example: "lucene"
- orderByoptionalstring
  ORDER BY expression. Empty uses the source default.
  
  Example: "Timestamp DESC"
- tagsoptionalarray ofstring
  Tags used to organize saved searches.
  
  maxLength: 32
  Example: ["production","errors"]
- filtersoptionalarray ofobject
  Structured pinned filters applied to the search.
  
  Example: [{"type":"sql","condition":"ServiceName IN ('checkout', 'payments')"}]
  2 properties
  conditionstringrequired
  SQL predicate applied to the search, in <column> IN (...) form.
  
  maxLength: 8192
  Example: "ServiceName IN ('checkout', 'payments')"
  typeoptionalsql
  Always sql. Only SQL predicate filters render in the sidebar.
  
  Default: "sql" · Example: "sql"
- teamIdoptionalstring
  ID of the team that owns the saved search.
  
  Example: "507f1f77bcf86cd799439013"
- createdAtoptionalstring
  Creation timestamp.
  
  format: date-time
  Example: "2025-01-01T00:00:00.000Z"
- updatedAtoptionalstring
  Last update timestamp.
  
  format: date-time
  Example: "2025-06-15T10:30:00.000Z"

Create Saved Search

curl --request POST \
  --url /api/v2/saved-searches \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data @- <<EOF
{
  "name": "Production Errors",
  "sourceId": "507f1f77bcf86cd799439012",
  "select": "Timestamp, ServiceName, Body",
  "where": "SeverityText:ERROR",
  "whereLanguage": "lucene",
  "orderBy": "Timestamp DESC",
  "tags": [
    "production",
    "errors"
  ],
  "filters": [
    {
      "type": "sql",
      "condition": "ServiceName IN ('checkout', 'payments')"
    }
  ]
}
EOF

const url = '/api/v2/saved-searches';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json', Authorization: 'Bearer <token>'},
  body: JSON.stringify({
    name: 'Production Errors',
    sourceId: '507f1f77bcf86cd799439012',
    select: 'Timestamp, ServiceName, Body',
    where: 'SeverityText:ERROR',
    whereLanguage: 'lucene',
    orderBy: 'Timestamp DESC',
    tags: ['production', 'errors'],
    filters: [{type: 'sql', condition: 'ServiceName IN (\'checkout\', \'payments\')'}]
  })
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));

import requests

url = "/api/v2/saved-searches"

payload = {
    "name": "Production Errors",
    "sourceId": "507f1f77bcf86cd799439012",
    "select": "Timestamp, ServiceName, Body",
    "where": "SeverityText:ERROR",
    "whereLanguage": "lucene",
    "orderBy": "Timestamp DESC",
    "tags": ["production", "errors"],
    "filters": [
        {
            "type": "sql",
            "condition": "ServiceName IN ('checkout', 'payments')"
        }
    ]
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Bearer <token>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

Response example

{
  "data": {
    "id": "507f1f77bcf86cd799439011",
    "name": "Production Errors",
    "sourceId": "507f1f77bcf86cd799439012",
    "select": "Timestamp, ServiceName, Body",
    "where": "SeverityText:ERROR",
    "whereLanguage": "lucene",
    "orderBy": "Timestamp DESC",
    "tags": [
      "production",
      "errors"
    ],
    "filters": [
      {
        "type": "sql",
        "condition": "ServiceName IN ('checkout', 'payments')"
      }
    ],
    "teamId": "507f1f77bcf86cd799439013",
    "createdAt": "2025-01-01T00:00:00.000Z",
    "updatedAt": "2025-06-15T10:30:00.000Z"
  }
}

{
  "message": "NOT_FOUND: Alert not found"
}

{
  "message": "NOT_FOUND: Alert not found"
}

{
  "message": "NOT_FOUND: Alert not found"
}

Authorizations

Request bodyJSON

Response

200

400

401

403