# Logz.io: Search Logs

Searches Logz.io logs using Elasticsearch DSL query syntax across a specified time range to pull diagnostic data for an incident.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Search for logs in Logz.io using Elasticsearch DSL query syntax within a specified time range. This action enables automated log analysis during incident response, allowing teams to programmatically retrieve diagnostic data without manual searches in the Logz.io UI.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

| Name                       | Description                                                                                                                      |
| :------------------------- | :------------------------------------------------------------------------------------------------------------------------------- |
| **Connection Input**       | The Logz.io Connection.                                                                                                          |
| **Query**                  | Elasticsearch DSL query as a JSON string. Example: `{"match": {"message": "error"}}`. Use `{"match_all": {}}` for all logs.      |
| **Start Time**             | Start time for the log search. Accepts a predefined relative time or an ISO 8601 timestamp, for example, `2025-10-07T14:00:00Z`. |
| **End Time**               | End time for the log search. Accepts a predefined relative time or an ISO 8601 timestamp, for example, `2025-10-07T16:00:00Z`.   |
| **Size**<br />_(Optional)_ | Maximum number of log entries to return. Maximum: 1000.                                                                          |

## Outputs

| Name                 | Description                                                                         |
| :------------------- | :---------------------------------------------------------------------------------- |
| **Logs**             | Array of log entries retrieved.                                                     |
| **Log Count**        | Total number of log entries returned.                                               |
| **Query Used**       | The query sent to Logz.io.                                                          |
| **Time Range Start** | The start time used for the search.                                                 |
| **Time Range End**   | The end time used for the search.                                                   |
| **Result**           | Value that shows if the action was successful or not. Either `Success` or `Failed`. |
| **Result Summary**   | Brief description of what the action did or if it failed.                           |
| **Error**            | Brief description that is populated if the action failed.                           |

> **Query syntax:** The Query input must be a valid Elasticsearch DSL query expressed as a JSON string, for example, `{"match": {"message": "error"}}`. Use `{"match_all": {}}` to retrieve all logs within the time range.

<br />