Times and windows

Times in answers

Instants are epoch milliseconds (UTC), as integers: 1793000000000. Dates without a time of day are YYYY-MM-DD. A few fields are exact stored text instead, and say so: a domain’s changed values (old, new) are strings.

Choosing a window

An operation that reads over time takes a window, in one of two forms:

Form	Example	Meaning
period	period=3h, period=2w	The last 1 to 9,999 minutes (m), hours (h), days (d) or weeks (w), ending now.
from and to	from=1792990000000&to=1793000000000	Epoch milliseconds, or RFC 3339 with an offset (2026-10-30T09:00:00+01:00).

Send one form or the other. The answer repeats the window it used as window{from, to}.

Each operation has a default window (used when you send none) and a longest window; a longer one is 422 invalid_request on period, to or end.

Operation	Default	Longest
Server metrics, custom metric series	1 day	31 days
Log search, log facets	1 hour	1 day
Log histogram, database queries	1 day	7 days
Incidents, a server’s incidents, database schema changes	every row	none

A window that starts before the oldest data kept is served from the oldest data (the answer’s window.from shows where). A window that ends before the data begins, or in the future, is refused.

Series

Server metrics and custom metric series answer points as [t, value]: t in epoch milliseconds and value a number or null. What a point is of its step (a peak, an average) is named per series. A series a server does not report is absent, never zero.