---
title: Logs
description: Read a service's runtime output and HTTP request logs, search build, deploy and job output, and fetch logs from the API.
section: Observability
order: 1
---

Runtime logs hold what a running service writes to standard output and standard error, and HTTP request logs record each request a web service answers. Each deployment also keeps its own build and deploy output, which [Deployments](/docs/deployments#read-a-deployments-logs) covers, and each cron job run keeps its output under the job's **Runs**.

## Read runtime logs

Open the project's **Logs** tab and pick a service. New lines appear as they arrive, and scrolling up stops following them until you choose **Jump to latest**. **Jump to first error** goes to the first line that looks like an error, and the **Filter** box narrows the view to lines that contain your text.

```bash tab="cURL"
curl "https://api.dekka.cloud/v1/resources/$SERVICE_ID/logs?after=0&limit=500" \
  -H "Authorization: Bearer $DEKKA_API_KEY"
```

Each line has a `seq`, a timestamp, its `stream` and the `line` itself. To follow new lines, call again with `after` set to the `next_after` from the last response. A page holds up to 1,000 lines.

## Read HTTP request logs

For a web service, choose **HTTP requests** next to the service picker. Each request shows its time, method, path, status, duration and response size. Narrow them with the **Status** menu, which takes a class such as 5xx, and **Path starts with**, such as `/api`.

```bash tab="cURL"
curl "https://api.dekka.cloud/v1/resources/$SERVICE_ID/http-logs?status=5xx&path_prefix=/api" \
  -H "Authorization: Bearer $DEKKA_API_KEY"
```

The API also accepts an exact status such as `status=404`. Dekka never stores the client's IP address, only a salted hash of it as `client_ip_hash`. Workers and cron jobs don't serve HTTP, so they have no request logs, and asking for them answers 422 `not_supported`.

## Search across the environment

Choose **Search all** to search the build and deploy output of every deployment, and the output of every cron job run, in the environment. Type a word such as `timeout` or a request ID, and narrow the results to the build, deploy or runtime stream. Results come newest first.

```bash tab="cURL"
curl "https://api.dekka.cloud/v1/projects/$PROJECT_ID/logs/search?q=timeout&environment_id=$ENV_ID" \
  -H "Authorization: Bearer $DEKKA_API_KEY"
```

The search also takes `resource_id`, `stream`, `since` and `until`, and pages with the `cursor` from the previous response. Runtime logs of web services and workers aren't part of it, so read those from the service's own runtime logs.