Read a substrate service's recent logs (from VictoriaLogs).
curl --request GET \ --url 'https://stratum.example.com/v1/admin/substrate/services/example/logs?limit=200' \ --header 'Authorization: Bearer <token>'Bootstrap-admin endpoint returning recent log lines for one
substrate service (e.g. stratum-controlplane, victoriametrics,
ovn-central). The substrate observability pipeline already ships
every service’s journald output into VictoriaLogs tagged
scope=substrate, service.name=<name>, and node_id; this
endpoint runs a scoped LogsQL query so operators can read a
service’s logs from the product instead of SSH-ing for
journalctl.
The service name is matched against the service.name VL label;
the query is ALWAYS constrained to scope:substrate server-side so
a request can never read customer (scope=tenant) logs. Optional
node narrows to one node’s instance; since/until bound the
time window; limit caps the line count (newest first).
Names come from the substrate services list and can be passed
through verbatim. A trailing .service is also accepted and
normalized away, because that is the spelling the inventory used to
report for native systemd units and the log pipeline never writes it
(the collector strips .service from the unit name and leaves every
other unit type — podman.socket — alone). Both spellings therefore
resolve to the same lines; asking with the wrong one used to return
an empty 200, indistinguishable from a service that had simply been
quiet.
Ceph daemons are a special case, handled server-side. The services
list collapses cephadm’s per-daemon units into a stable group
(ceph-mon, ceph-osd.0) so the UI can roll them up across nodes,
while the log pipeline records the full unit
(ceph-<fsid>@mon.<host>). Asking for the group name resolves to
that group’s units rather than matching nothing, so Ceph names from
the inventory work here like every other name.
. Cross-ref the substrate services list above (same bootstrap-admin Cedar gate) and (logs).
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The substrate service.name label, exactly as the services list reports it (e.g. stratum-controlplane, ovn-controller, podman.socket). A trailing .service is accepted and stripped.
Query Parameters
Section titled “Query Parameters”Narrow to one node’s logs by node_id. Empty = all nodes.
Keep only the lines about one instance: an instance
id (i-…) or instance ARN. Matches the instance_id field and
the control plane’s older instanceId / instance spellings.
Anything else is a 400 UNSUPPORTED_RESOURCE.
RFC3339 lower time bound. Empty = VL default lookback.
RFC3339 upper time bound. Empty = now.
Max lines to return (newest first). Default 200, max 5000.
Responses
Section titled “Responses”Recent log events for the service.
object
object
Free-form severity tag (e.g. info, warn, error). Optional.
Arbitrary structured fields. Reserved keys (project_id,
log_group, log_stream, timestamp, message, level) are
silently prefixed with field_ to avoid collisions with
the Stratum-injected stream-key labels.
object
True when the server had more rows than it returned. The response is a valid prefix of the result, not the whole of it.
Without this flag a client at the server’s row ceiling receives a full
page and no nextPageToken, which means “this is
the complete set” — so data it never saw would be indistinguishable
from data that does not exist.
It does not imply a cursor exists. These queries do not all sort on a total order, so a resumable token cannot be minted for them yet. The remedy is to narrow the request (filter, or a shorter time range), not to page.
Example generated
{ "items": [ { "timestamp": "2026-04-15T12:00:00Z", "level": "example", "message": "example", "fields": {} } ], "nextPageToken": "example", "isTruncated": true}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}VictoriaLogs backend unavailable (no logs read path configured).
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}