Export Logs - Ngris

Export Traffic Logs

GET /v1/traffic/logs/export

Download traffic logs as a single CSV or JSON file for ETL into external systems (Splunk, Datadog, BigQuery, S3 archive). The platform sets Content-Disposition: attachment so browsers prompt to save. The export covers a trailing time window (in days) and is capped per request — slice by day for larger archives.

Plan-gated: requires the traffic_inspector entitlement. Callers without it receive 403 Forbidden.

Query parameters

format string

json (default) or csv.

days int

Trailing window to export, in days. Range 1–365. Default 7.

endpoint_uuid, rate_limit_rule_uuid, policy_uuid, … string (uuid)

Optional. Every filter of List Traffic Logs applies, so the export matches what the inspector shows — e.g. endpoint_uuid restricts it to one endpoint.

limit int

Maximum rows to export. Range 1–5000. Default 5000.

Deprecated: endpoint_id, rate_limit_rule_id and since_id (integers) and policy_id are still accepted until the sunset. Send endpoint_uuid, rate_limit_rule_uuid, since_uuid and policy_uuid; sending both forms for different objects is a 400 id_uuid_mismatch.

Response (200 OK)

Download (Content-Disposition: attachment).

format=csv: Content-Type: text/csv. Header row: ID, Timestamp, Method, Host, Path, Source IP, Country, ASN, Status Code, Origin Status, Duration (ms), TTFB (ms), Bytes In, Bytes Out, User Agent, Firewall Action, Rate Limit Action, Is Replay, UUID, Request ID.
format=json: Content-Type: application/json. A single object {exported_at, count, logs: [...]} where each logs entry is {uuid, request_id, timestamp, method, host, path, source_ip, country, asn, status_code, origin_status, duration_ms, latency_ms, bytes_in, bytes_out, user_agent, firewall_action, rate_limit_action, is_replay}.

Public ids: each entry is identified by its uuid — the CSV UUID column (the last one, so no existing column moves) and the JSON uuid key — the same id List Traffic Logs and Get Traffic Log use. The CSV ID column and the JSON id key (integers) are deprecated and removed at the sunset; don't store them. An entry the platform hasn't assigned a uuid yet (only very old ones) has an empty UUID cell / "uuid": null.

Request id: the CSV Request ID column (after UUID) and the JSON request_id key carry the edge's X-Request-Id for each request, as in List Traffic Logs; empty / null when the entry has none (TCP/UDP sessions, older entries).

Errors

400 Bad Request

Invalid format (must be json or csv), a malformed *_uuid filter, id_uuid_mismatch, or an integer id after the sunset (integer_id_unsupported).

401 Unauthorized

Missing auth.

403 Forbidden

Plan doesn't include the traffic_inspector entitlement.

Request — CSV, last 7 days
curl "https://api.ngris.com/v1/traffic/logs/export?format=csv&days=7&endpoint_uuid=019bb1e4-e785-77d2-9966-c3cff31d0a0e" \
  -H "X-API-KEY: <your_api_key>" \
  -o logs.csv

Python — JSON export
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
export = client._get_raw(
    "/traffic/logs/export",
    params={"format": "json", "days": 7, "endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e"},
)
print(f"{export['count']} rows")
for log in export["logs"]:
    if log["status_code"] >= 500:
        print(log)

Response — 200 OK (CSV header row)
ID,Timestamp,Method,Host,Path,Source IP,Country,ASN,Status Code,Origin Status,Duration (ms),TTFB (ms),Bytes In,Bytes Out,User Agent,Firewall Action,Rate Limit Action,Is Replay,UUID,Request ID

Response — 200 OK (JSON)
{
  "exported_at": "2026-04-29T13:05:00Z",
  "count": 1,
  "logs": [
    {
      "uuid": "019dd9a0-6b61-7c2e-9d4f-3a8c2e1b7f50",
      "request_id": "4f9c2b7e1d0a8c3b6e5f7a9d2c1b0e8f",
      "timestamp": "2026-04-29T13:01:23Z",
      "method": "GET",
      "host": "my-api.ngris.dev",
      "path": "/api/users",
      "source_ip": "203.0.113.42",
      "country": "DE",
      "asn": "AS64496",
      "status_code": 500,
      "origin_status": 500,
      "duration_ms": 1247,
      "latency_ms": 1243,
      "bytes_in": 0,
      "bytes_out": 234,
      "user_agent": "curl/8.4.0",
      "firewall_action": "no_match",
      "rate_limit_action": "allowed",
      "is_replay": false
    }
  ]
}

Was this helpful?

PreviousReplay Log Entry NextServing Regions

On this page

Export Traffic Logs

Was this helpful?