Tenant log search syntax: query filters that find the exact failure

# Tenant log search

## The syntax

Monitoring > Logs search box accepts Lucene-style queries. The ones that matter:

- `type:f` failed logins; `type:s` successes. Full type codes are in the docs.
- `user_id:"auth0|abc123"` exact user. `user_name:"[the user email]"`.
- `client_id:"YOUR_CLIENT_ID"` scope to one app.
- `connection:"google-oauth2"` or `connection:"Username-Password-Authentication"`.
- `description:*denied*` wildcard on the description.
- Date ranges: the dashboard picker, or `date:[2026-09-26 TO 2026-09-27]` in API queries.
- Combine: `type:f AND client_id:"xxx" AND user_name:"y@"` finds one user's failures on one app.

## Management API search

`GET /api/v2/logs?q=type:f AND user_id:"auth0|123"&per_page=50&sort=date:-1`. Script this; the dashboard is for humans, the API is for incidents.

## Log retention

Retention depends on the subscription tier (days to months). If the incident is older than retention, the logs are gone; this is the argument for log streaming to your SIEM before you need it.

## PII

Logs can contain PII. The docs describe PII handling and obfuscation options for streams. Do not paste raw log lines into public issues.

## Verify

Run the query for a known recent login and confirm it returns the event. Save the team's top five queries in the runbook so incidents start from a template, not a blank box.