Get an alert definition by ID

GET /v1/alert_definitions/{id}

Get details of an existing alert by using the alert ID.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.read

Auditing

Calling this method generates the following auditing event.

logs.alert-config.get

Request

Response

HTTP status code associated with the error

Update an alert definition by ID

PUT /v1/alert_definitions/{id}

Update an alert definition

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.manage

Auditing

Calling this method generates the following auditing event.

logs.alert-config.update

Request

Request Body

AlertDefinitionPrototype

name

Required *

start_time

Required *

object

Start time of the alert activity

end_time

Required *

object

Start time of the alert activity

type

phantom_mode

boolean

Whether the alert is in phantom mode (creating incidents or not) Phantom alerts serve as building blocks for flow alerts without triggering independent notifications. Enabling this will remove the 'Notifications' section from the alert definition.

deleted

boolean

Whether the alert has been marked as deleted

Response

HTTP status code associated with the error

Delete an alert definition by ID

DELETE /v1/alert_definitions/{id}

Delete an alert definition

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.manage

Auditing

Calling this method generates the following auditing event.

logs.alert-config.delete

Request

Response

HTTP status code associated with the error

List alert definitions

GET /v1/alert_definitions

List alert definitions

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.read

Auditing

Calling this method generates the following auditing event.

logs.alert-config.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create an alert definition

POST /v1/alert_definitions

Create an alert definition

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.manage

Auditing

Calling this method generates the following auditing event.

logs.alert-config.create

Request

Request Body

AlertDefinitionPrototype

name

Required *

start_time

Required *

object

Start time of the alert activity

end_time

Required *

object

Start time of the alert activity

type

phantom_mode

boolean

deleted

boolean

Whether the alert has been marked as deleted

Response

HTTP status code associated with the error

Get an alert by ID

GET /v1/alerts/{id}

Get an alert by ID.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.read

Auditing

Calling this method generates the following auditing event.

logs.alert-config.get

Request

Response

HTTP status code associated with the error

Update an alert

PUT /v1/alerts/{id}

Update an alert.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.manage

Auditing

Calling this method generates the following auditing event.

logs.alert-config.update

Request

Request Body

AlertPrototype

name

Required *

string

Alert name

description

string

Alert description

is_active

Required *

boolean

Alert is active

severity

Required *

timeframes

Required *

array

Activity timeframes of the alert

notification_payload_filters

array

The JSON keys to be included in the alert notification. If unspecified, the full log text will be included in the alert notification.

meta_labels

array

The Meta labels to add to the alert

meta_labels_strings

array

The meta data added to the alert as a string separated by a ":" character.

incident_settings

AlertsV2AlertIncidentSettings

Incident settings, will create the incident based on this configuration

retriggering_period_seconds

integer

The retriggering period of the alert in seconds

notify_on

string

Notify on setting

use_as_notification_settings

boolean

Use these settings for all notificaion webhook

Response

HTTP status code associated with the error

Delete an alert

DELETE /v1/alerts/{id}

Delete an alert

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.manage

Auditing

Calling this method generates the following auditing event.

logs.alert-config.delete

Request

Response

HTTP status code associated with the error

List alerts

GET /v1/alerts

List alerts

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.read

Auditing

Calling this method generates the following auditing event.

logs.alert-config.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create an alert

POST /v1/alerts

Create an alert

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.alert-config.manage

Auditing

Calling this method generates the following auditing event.

logs.alert-config.create

Request

Request Body

AlertPrototype

name

Required *

string

Alert name

description

string

Alert description

is_active

Required *

boolean

Alert is active

severity

Required *

timeframes

Required *

array

Activity timeframes of the alert

notification_payload_filters

array

The JSON keys to be included in the alert notification. If unspecified, the full log text will be included in the alert notification.

meta_labels

array

The Meta labels to add to the alert

meta_labels_strings

array

The meta data added to the alert as a string separated by a ":" character.

incident_settings

AlertsV2AlertIncidentSettings

Incident settings, will create the incident based on this configuration

retriggering_period_seconds

integer

The retriggering period of the alert in seconds

notify_on

string

Notify on setting

use_as_notification_settings

boolean

Use these settings for all notificaion webhook

Response

HTTP status code associated with the error

Submit a background query to be processed asynchronously.

POST /v1/background_query

Submits a query that runs in the background, allowing the client to continue without waiting for the results immediately.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.legacy-archive-query.execute

Auditing

Calling this method generates the following auditing event.

logs.archive-queries.submit

Request

Beginning of the time range for the query, default: end - 15 minutes or current time - 15 minutes if end is not defined.

end_date

string

End of the time range for the query. Default: start + 15 minutes or current time if start is not defined

now_date

string

Contextual `now` for the query, default: current time. Used by functions like now() in DataPrime.

Response

List of errors

trace

string

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Get the status of a background query

GET /v1/background_query/{query_id}/status

Get the status of a background query

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.legacy-archive-query.execute

Auditing

Calling this method generates the following auditing event.

logs.archive-queries.status

Request

HTTP status code associated with the error

Get the data of a background query

GET /v1/background_query/{query_id}/data

Retrieves the result of a previously submitted background query using its query ID.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.legacy-archive-query.execute

Auditing

Calling this method generates the following auditing event.

logs.archive-queries.get-data

Request

Response

HTTP status code associated with the error

Cancel a background query

POST /v1/background_query/{query_id}/cancel

Cancel a background query

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.legacy-archive-query.execute

Auditing

Calling this method generates the following auditing event.

logs.archive-queries.cancel

Request

Response

HTTP status code associated with the error

Get service instance's Data Access Rules by ids

GET /v1/data_access_rules

Get service instance's Data Access Rules by ids

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.data-access-rule.read

Auditing

Calling this method generates the following auditing event.

logs.data-access-rule.list

Request

Path Parameters

Query Parameters

id

array

Array of data access rule IDs

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create a data access rule

POST /v1/data_access_rules

Create a data access rule

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.data-access-rule.manage

Auditing

Calling this method generates the following auditing event.

log.data-access-rule.create

Request

Request Body

DataAccessRulePrototype

display_name

Required *

string

Display Name for the data access rule

description

string

Description for the data access rule

filters

Required *

array

Filters for the data access rule

default_expression

Required *

string

Default Expression for the data access rule

Response

201 - Created

id

string

Data access rule ID

display_name

HTTP status code associated with the error

Update a data access rule

PUT /v1/data_access_rules/{id}

Update a data access rule

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.data-access-rule.manage

Auditing

Calling this method generates the following auditing event.

logs.data-access-rule.update

Request

Request Body

DataAccessRulePrototype

display_name

Required *

string

Display Name for the data access rule

description

string

Description for the data access rule

filters

Required *

array

Filters for the data access rule

default_expression

Required *

string

Default Expression for the data access rule

Response

200 - OK

id

string

Data access rule ID

display_name

HTTP status code associated with the error

Delete a data access rule

DELETE /v1/data_access_rules/{id}

Delete a data access rule

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.data-access-rule.manage

Auditing

Calling this method generates the following auditing event.

logs.data-access-rule.delete

Request

Response

HTTP status code associated with the error

Get data usage metrics export status or return data usage report

GET /v1/data_usage

Get data usage metrics export status when invoked without query parameters. Get daily or detailed data usage report when invoked with query parameters.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.data-usage.read

Auditing

Calling this method generates the following auditing event.

logs.data-usage.get

Request

Path Parameters

Query Parameters

range

The range of days to retrieve data usage, by default it will use current month

query

Query to filter daily or detailed the data usage, by default it will use daily one

Response

HTTP status code associated with the error

Update data usage metrics export status

PUT /v1/data_usage

Update data usage metrics export status

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.data-usage.manage

Auditing

Calling this method generates the following auditing event.

logs.data-usage-to-metrics.enable

Request

Request Body

DataUsageMetricsExportStatus

enabled

Required *

boolean

Whether metrics export is enabled or not. When 'true' metrics are exported.

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

List all enrichments

GET /v1/enrichments

List all enrichments

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.geo-enrichment.read
logs.custom-enrichment.read
logs.security-enrichment.read
logs.custom-enrichment-data.read

Auditing

Calling this method generates the following auditing event.

logs.enrichment.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create an enrichment

POST /v1/enrichments

Create an enrichment

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.geo-enrichment.manage
logs.custom-enrichment.manage
logs.security-enrichment.manage

Auditing

Calling this method generates the following auditing event.

logs.geo-enrichment.create
logs.custom-enrichment.create
logs.security-enrichment.create

Request

Request Body

EnrichmentPrototype

field_name

Required *

string

The name of the field to enrich

enrichment_type

Required *

EnrichmentV1EnrichmentType

integer

HTTP status code associated with the error

Delete enrichments

DELETE /v1/enrichments/{id}

Delete enrichments

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.geo-enrichment.manage
logs.custom-enrichment.manage
logs.security-enrichment.manage

Auditing

Calling this method generates the following auditing event.

logs.geo-enrichment.delete
logs.custom-enrichment.delete
logs.security-enrichment.delete

Request

Response

HTTP status code associated with the error

Lists events to metrics definitions

GET /v1/events2metrics

Lists events to metrics definitions

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.events2metrics.read

Auditing

Calling this method generates the following auditing event.

logs.events2metrics.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Creates events to metrics definitions

POST /v1/events2metrics

Creates events to metrics definitions

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.events2metrics.manage

Auditing

Calling this method generates the following auditing event.

logs.events2metrics.update

Request

Request Body

Event2MetricPrototype

name

Required *

HTTP status code associated with the error

Gets events to metrics definitions by ID

GET /v1/events2metrics/{id}

Gets events to metrics definitions by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.events2metrics.read

Auditing

Calling this method generates the following auditing event.

logs.events2metrics.get

Request

Response

HTTP status code associated with the error

Updates events to metrics definitions

PUT /v1/events2metrics/{id}

Updates events to metrics definitions

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.events2metrics.manage

Auditing

Calling this method generates the following auditing event.

logs.events2metrics.update

Request

Request Body

Event2MetricPrototype

name

Required *

HTTP status code associated with the error

Deletes events to metrics definitions by ID

DELETE /v1/events2metrics/{id}

Deletes events to metrics definitions by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.events2metrics.manage

Auditing

Calling this method generates the following auditing event.

logs.events2metrics.delete

Request

Response

HTTP status code associated with the error

Get an extension by ID

GET /v1/extensions/{id}

Get an extension by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.extension-config.read

Auditing

Calling this method generates the following auditing event.

logs.extension.read

Request

Response

200 - OK

id

string

The ID of the Extension.

name

string

The name of the Extension.

revisions

array

The list of all revisions of the Extension, each representing a versioned snapshot of the Extension's functionality and appearance.

keywords

HTTP status code associated with the error

Get deployment details of an extension

GET /v1/extensions/{id}/deployment

Get deployment details of an extension using id of an extension

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.extension-config.read

Auditing

Calling this method generates the following auditing event.

logs.extension.read

Request

Response

200 - OK

version

HTTP status code associated with the error

Deploy or update deployment of an extension.

PUT /v1/extensions/{id}/deployment

Deploy or update deployment of an extension using extension ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.extension.manage

Auditing

Calling this method generates the following auditing event.

logs.extension.update
logs.extension.deploy

Request

Request Body

ExtensionDeployment

Deployment payload for the extension. `version` and `item_ids` are required.

version

Required *

string

The version of the Extension revision to deploy.

item_ids

Required *

array

The list of Extension item IDs to deploy.

applications

array

Applications that the Extension is deployed for. When this is empty, it is applied to all applications.

subsystems

array

Subsystems that the Extension is deployed. When this is empty, it is applied to all subsystems.

Response

200 - OK

version

HTTP status code associated with the error

Delete deployment of an extension

DELETE /v1/extensions/{id}/deployment

Delete deployment of an extension using extension ID.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.extension.manage

Auditing

Calling this method generates the following auditing event.

logs.extension.delete

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Get list of extensions

GET /v1/extensions

Get list of extensions

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.extension-config.read

Auditing

Calling this method generates the following auditing event.

logs.extensions.list
logs.deployed-extensions.list

Request

Path Parameters

Query Parameters

deployed

boolean

Optional deployment filter. If omitted, returns all extensions. If true, returns only deployed extensions. If false, returns only non-deployed extensions.

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

List view's folders

GET /v1/view_folders

List view's folders

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.read

Auditing

Calling this method generates the following auditing event.

logs.view-folder.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create view folder

POST /v1/view_folders

Create view folder

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.manage

Auditing

Calling this method generates the following auditing event.

logs.view-folder.create

Request

Request Body

ViewFolderPrototype

name

Required *

string

View folder name

Response

List of errors

trace

string

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Get view folder

GET /v1/view_folders/{id}

Get view folder

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.read

Auditing

Calling this method generates the following auditing event.

logs.view-folder.get

Request

Response

List of errors

trace

string

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Replaces an existing view folder

PUT /v1/view_folders/{id}

Replaces an existing view folder

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.manage

Auditing

Calling this method generates the following auditing event.

logs.view-folder.update

Request

Request Body

ViewFolderPrototype

name

Required *

string

View folder name

Response

List of errors

trace

string

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Deletes a view folder by ID

DELETE /v1/view_folders/{id}

Deletes a view folder by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.manage

Auditing

Calling this method generates the following auditing event.

logs.view-folder.delete

Request

Response

HTTP status code associated with the error

Get log data retention tags

GET /v1/log_data_retention_tags

Get log data retention tags. Returns 404 if retention tags have not been activated.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.archive-retention.read

Auditing

Calling this method generates the following auditing event.

logs.retentions.get

Request

Response

HTTP status code associated with the error

Update log data retention tags

PUT /v1/log_data_retention_tags

Update log data retention tags. If retention tags have not been activated yet, the first successful PUT request will activate them. An archive bucket must be configured before retention tags can be activated.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.archive-retention.manage

Auditing

Calling this method generates the following auditing event.

logs.retentions.update

Request

Request Body

LogDataRetentionTags

Response

HTTP status code associated with the error

List Outbound Integrations.

GET /v1/outgoing_webhooks

List Outbound Integrations.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.webhook.read

Auditing

Calling this method generates the following auditing event.

logs.webhook.list

Request

Path Parameters

Query Parameters

type

The type of the deployed outbound integrations to list.

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create an outbound integration.

POST /v1/outgoing_webhooks

Create an outbound integration.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.webhook.manage

Auditing

Calling this method generates the following auditing event.

logs.webhook.crete

Request

The URL of the outbound integration. This value is null for IBM Events Notifications integration.

Response

201 - Created

id

string

The ID of the outbound integration.

type

string

The type of the deployed outbound integrations to list.

name

string

The name of the outbound integration.

url

HTTP status code associated with the error

Gets an outbound integration by ID.

GET /v1/outgoing_webhooks/{id}

Gets an outbound integration by ID.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.webhook.read

Auditing

Calling this method generates the following auditing event.

logs.webhook.get

Request

Response

200 - OK

id

string

The ID of the outbound integration.

type

string

The type of the deployed outbound integrations to list.

name

string

The name of the outbound integration.

url

HTTP status code associated with the error

Update an outbound integration.

PUT /v1/outgoing_webhooks/{id}

Update an outbound integration.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.webhook.manage

Auditing

Calling this method generates the following auditing event.

logs.webhook.update

Request

The URL of the outbound integration. This value is null for IBM Events Notifications integration.

Response

200 - OK

id

string

The ID of the outbound integration.

type

string

The type of the deployed outbound integrations to list.

name

string

The name of the outbound integration.

url

HTTP status code associated with the error

Delete an outbound integration.

DELETE /v1/outgoing_webhooks/{id}

Delete an outbound integration.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.webhook.manage

Auditing

Calling this method generates the following auditing event.

logs.webhook.delete

Request

Response

HTTP status code associated with the error

Gets policy by ID

GET /v1/policies/{id}

Gets policy by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-tco-policy.read

Auditing

Calling this method generates the following auditing event.

logs.logs-tco-policy.get

Request

Response

HTTP status code associated with the error

Updates an existing policy

PUT /v1/policies/{id}

Updates an existing policy

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-tco-policy.manage

Auditing

Calling this method generates the following auditing event.

logs.logs-tco-policy.update

name

HTTP status code associated with the error

Deletes an existing policy

DELETE /v1/policies/{id}

Deletes an existing policy

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-tco-policy.manage

Auditing

Calling this method generates the following auditing event.

logs.logs-tco-policy.delete

Request

Response

HTTP status code associated with the error

Gets policies

GET /v1/policies

Gets policies

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-tco-policy.read

Auditing

Calling this method generates the following auditing event.

logs.logs-tco-policy.list

Request

Path Parameters

Query Parameters

enabled_only

boolean

Optionally filter only enabled policies

source_type

Source type used to filter policies

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Creates a new policy

POST /v1/policies

Creates a new policy

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-tco-policy.manage

Auditing

Calling this method generates the following auditing event.

logs.logs-tco-policy.create

name

HTTP status code associated with the error

Run a query to search the logs

POST /v1/query

Run a query to search the logs. Note that this is a SSE (Server Sent Events) API and the content type of the response is text/event-stream

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-data-api-high.read
logs.logs-data-api-low.read

Auditing

Calling this method generates the following auditing event.

logs.logs-data.search

Request

Request Body

QueryRequest

query

Required *

HTTP status code associated with the error

Gets rule group by groupid

GET /v1/rule_groups/{group_id}

Gets rule group by groupid

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.parsing-rule.get

Auditing

Calling this method generates the following auditing event.

logs.parsing-rule.read

Request

Response

200 - OK

id

string

The ID of the rule group

name

string

The name of the rule group

description

string

A description of the rule group. The description will describe the purpose of the rule group.

enabled

HTTP status code associated with the error

Updates rule group by groupid

PUT /v1/rule_groups/{group_id}

Updates rule group by groupid

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.parsing-rule.manage

Auditing

Calling this method generates the following auditing event.

logs.parsing-rule.update

Request

Request Body

RuleGroupPrototype

name

Required *

string

The name of the rule group

description

string

A description of the rule group. The description will describe the purpose of the rule group.

enabled

boolean

Whether or not the rule is enabled

rule_matchers

array

Optional rule matchers which, if matched, will process the rule through the rule group

rule_subgroups

Required *

array

Rule subgroups. The first rule subgroup will be executed first. If there is no match, subsequent rule groups will be attempted until there is a match. Rule groups are attempted in order.

order

integer

The order in which the rule group will be evaluated. The lower the order, the more priority the group will have. Not providing the order will, by default, create a group with the last order.

Response

200 - OK

id

string

The ID of the rule group

name

string

The name of the rule group

description

string

A description of the rule group. The description will describe the purpose of the rule group.

enabled

HTTP status code associated with the error

Deletes rule group by groupid

DELETE /v1/rule_groups/{group_id}

Deletes rule group by groupid

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.parsing-rule.manage

Auditing

Calling this method generates the following auditing event.

logs.parsing-rule.delete

Request

Response

HTTP status code associated with the error

Gets all rule groups

GET /v1/rule_groups

Gets all rule groups

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.parsing-rule.read

Auditing

Calling this method generates the following auditing event.

logs.parsing-rule.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Creates rule group

POST /v1/rule_groups

Creates rule group

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.parsing-rule.manage

Auditing

Calling this method generates the following auditing event.

logs.parsing-rule.create

Request

Request Body

RuleGroupPrototype

name

Required *

string

The name of the rule group

description

string

A description of the rule group. The description will describe the purpose of the rule group.

enabled

boolean

Whether or not the rule is enabled

rule_matchers

array

Optional rule matchers which, if matched, will process the rule through the rule group

rule_subgroups

Required *

array

Rule subgroups. The first rule subgroup will be executed first. If there is no match, subsequent rule groups will be attempted until there is a match. Rule groups are attempted in order.

order

integer

The order in which the rule group will be evaluated. The lower the order, the more priority the group will have. Not providing the order will, by default, create a group with the last order.

Response

201 - Created

id

string

The ID of the rule group

name

string

The name of the rule group

description

string

A description of the rule group. The description will describe the purpose of the rule group.

enabled

HTTP status code associated with the error

List all Event Streams.

GET /v1/streams

List all Event Streams.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-stream-setup.read

Auditing

Calling this method generates the following auditing event.

logs.logs-stream-setup.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Create an Event Stream Integration.

POST /v1/streams

Create an Event Stream Integration.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-stream-setup.manage

Auditing

Calling this method generates the following auditing event.

logs.logs-stream-setup.create

Request

Request Body

StreamPrototype

name

Required *

string

The name of the Event stream.

Response

HTTP status code associated with the error

Update an Event Stream.

PUT /v1/streams/{id}

Update an Event Stream.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-stream-setup.manage

Auditing

Calling this method generates the following auditing event.

logs.logs-stream-setup.update

Request

Request Body

StreamPrototype

name

Required *

string

The name of the Event stream.

Response

HTTP status code associated with the error

Delete an Event Stream integration by ID.

DELETE /v1/streams/{id}

Delete an Event Stream integration by ID.

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.logs-stream-setup.manage

Auditing

Calling this method generates the following auditing event.

logs.logs-stream-setup.delete

Request

Response

HTTP status code associated with the error

Lists all company public views

GET /v1/views

Lists all company public views

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.read
logs.private-view.read

Auditing

Calling this method generates the following auditing event.

logs.view.list

Request

Response

UUID uniquely identifying the request

status_code

integer

HTTP status code associated with the error

Creates a new view

POST /v1/views

Creates a new view

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.manage
logs.private-view.manage

Auditing

Calling this method generates the following auditing event.

logs.view.create

filters

ApisViewsV1SelectedFilters

View selected filters

filters

array

Selected filters

folder_id

string

View folder ID

tier

string

Type of view

Response

201 - Created

id

integer

View ID

name

string

View name

search_query

ApisViewsV1SearchQuery

View search query

time_selection

HTTP status code associated with the error

Gets a view by ID

GET /v1/views/{id}

Gets a view by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.read
logs.private-view.read

Auditing

Calling this method generates the following auditing event.

logs.view.get

Request

Response

200 - OK

id

integer

View ID

name

string

View name

search_query

ApisViewsV1SearchQuery

View search query

time_selection

HTTP status code associated with the error

Replaces an existing view

PUT /v1/views/{id}

Replaces an existing view

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.manage
logs.private-view.manage

Auditing

Calling this method generates the following auditing event.

logs.view.update

filters

ApisViewsV1SelectedFilters

View selected filters

filters

array

Selected filters

folder_id

string

View folder ID

tier

string

Type of view

Response

200 - OK

id

integer

View ID

name

string

View name

search_query

ApisViewsV1SearchQuery

View search query

time_selection

HTTP status code associated with the error

Deletes a view by ID

DELETE /v1/views/{id}

Deletes a view by ID

Authorization

To call this method, you must be assigned one or more IAM access roles that include the following action.

logs.shared-view.manage
logs.private-view.manage

Auditing

Calling this method generates the following auditing event.

logs.view.delete

Request

Response

HTTP status code associated with the error