Log Archive
ScryWatch stores all events in hot storage (D1) for 24 hours and simultaneously archives them to cold storage (Cloudflare R2) indefinitely. The Archive page lets you browse and query those older logs.
What you’ll need
- A project with events older than 24 hours
Note: Events appear in the Archive after the queue consumer writes them — typically within a few minutes of ingestion. The hot storage (Log Explorer) and archive are populated at the same time; the archive doesn’t require waiting 24 hours.
Step 1: Open Archive
Click Archive in the left sidebar.
You’ll see a date and hour picker at the top.
Step 2: Select a date and hour
Choose the date and hour you want to inspect from the picker controls.
ScryWatch archives are organized by logs/YYYY/MM/DD/HH.json.gz in R2. Each hour-bucket contains all events that arrived during that UTC hour.
Tip: If you’re investigating an incident that happened yesterday at 3pm UTC, select yesterday’s date and hour 15.
Step 3: Browse the archived events
After selecting a date and hour, the events for that period will load in a table.
The table shows the same fields as Log Explorer:
- Timestamp, level, service, message
Click any row to open the event detail panel with full metadata.
Step 4: Filter within the archive
Use the filter controls to narrow down events within the selected hour:
- Level — show only errors, warnings, etc.
- Service — filter to a specific service
- Search — keyword search within the archived messages
Step 5: Link to a raw event
From the event detail panel, copy the Event ID. This ID is stable — it refers to the same event whether you find it in Log Explorer or the Archive.
You can share event IDs with teammates for investigation, since they’re globally unique and persistent.
You’re done
You now know how to:
- Navigate to a specific date and hour in the archive
- Browse and filter archived events
- Open event detail from archived logs
Archive search in Log Explorer
You don’t always need to come to the Archive page to query old logs. Log Explorer automatically searches the archive when your time range extends beyond the last 24 hours.
When this happens, a chip next to the results count shows the storage tier that was used:
| Chip | Meaning |
|---|---|
| Hot | Results from the live D1 index (last 24h) |
| Archive | Results from R2 cold storage |
| Merged | Range spans both; results combined |
| ~approximate | Archive scan hit the 50,000-event cap — results may be incomplete |
If you see ~approximate, narrow your time range or add more specific filters to reduce the scan size.
Use the Archive page (this guide) when you want to browse a specific hour in full, without filters, or when you need the raw event bundle exactly as it was stored.
Related docs
The archive is built on Cloudflare R2. See the API reference for the archive query endpoint and the format of archived event bundles.