Retrieve Log Events Using the Management API

You can use the Management API to retrieve up to 100 log events per request using the Search Log Events endpoint, which supports two types of consumption:

By checkpoint: Recommended if you want to export log events to the external data analytics service.
By search criteria: Used by the Dashboard.

Logs stored by Auth0 are subject to a retention period based on your subscription.

You can also use the these endpoints to look for logs:

/api/v2/logs/{id}: Retrieves the single log entry associated with the provided log ID.
/api/v2/users/{user_id}/logs: Retrieves log events for a specific user ID.

This method allows you to retrieve log events from a particular log_id. To search by checkpoint, use the following parameters:

Parameter	Description
`from`	Log event ID to start retrieving logs. You can limit the amount of logs using the `take` parameter.
`take`	The total amount of entries to retrieve when using the `from` parameter.

The q or any parameter other than from and take will be ignored and the order by date is not precise.

This method allows you to retrieve log events that match the specified search criteria or, if no criteria is used, lists all events. To search by criteria use the following parameters:

Parameter	Description
`q`	Search criteria using Query String Syntax.
`page`	The zero-based page number.
`per_page`	The number of entries per page.
`sort`	The field to use for sorting. Use `field:order`, where `order` is `1` for ascending and `-1` for descending. For example `date:-1`.
`fields:`	A comma-separated field list to include or exclude (depending on `include_fields`) from the result. Leave empty to retrieve all fields.
`include_fields`	`true` if the fields specified are to be included in the result, `false` otherwise. Defaults to `true`.

For the list of fields that can be used in the search query and the fields and sort parameters, see Log Search Query Syntax.

Besides the limitation of 100 log events per request to retrieve logs, you may only paginate through up to 1,000 search results.

If you get the error 414 Request-URI Too Large this means that your query string is larger than the supported length. In this case, refine your search.

Private Cloud Search Field Limitations

For Private Cloud only the following fields are searchable:

user
connection
application
type
ip

Use double quotes for exact searches (e.g., application:"test" will search for all log events specific to the application named test, but application:test will search log events for applications with test in their name.

Docs