Managing IBM Cloud Logs targets
You can manage IBM Cloud Logs targets in your account by using the IBM Cloud Logs Routing UI, the IBM Cloud Logs Routing CLI, the IBM Cloud Logs Routing REST API, and Terraform scripts. A target is a resource where you can collect platform logs.
For more information on IBM Cloud Logs Routing targets, see Targets.
IAM Access
You must grant users IAM permissions to manage targets. For more information, see Assign access to resources.
When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.
If you have the IAM permission to create policies and authorizations, you can grant only the level of access that you have as a user of the target service. For example, if you have viewer access for the target service, you can assign only the viewer role for the authorization. If you attempt to assign a higher permission such as administrator, it might appear that permission is granted, however, only the highest level permission you have for the target service, that is viewer, will be assigned.
Users with regional scope will be limited to access targets in their authorized region.
| IAM action | IAM Policy scope | IAM Roles | Description |
|---|---|---|---|
logs-router.target.read |
Region | AdministratorEditorViewerOperator |
Read (view) information about a target |
logs-router.target.create |
Region | AdministratorEditor |
Create a target |
logs-router.target.update |
Region | AdministratorEditor |
Update a target |
logs-router.target.delete |
Region | AdministratorEditor |
Delete a target |
logs-router.target.list |
Account | AdministratorEditorViewerOperator |
List all targets |
Authentication
When writing to a IBM Cloud Logs target, you must configure a service-to-service (S2S) authorization between IBM Cloud Logs Routing and {{site.data.keyword. logs_full_notm}}.
Choose 1 of the following options:
CLI prerequisites
Before you use the CLI to manage targets, complete the following steps:
-
Log in to IBM Cloud. Run the following command: ibmcloud login
Creating an IBM Cloud Logs target using the CLI
Use this command to create a IBM Cloud Logs target:
ibmcloud logs-router target create --name TARGET_NAME --destination-crn CLOUD_LOGS_TARGET_CRN [--region REGION] [--managed-by MANAGED-BY] [--output FORMAT]
Where
--region REGION|-r REGION-
Name of the region, for example,
us-southoreu-gb. If not specified, the region logged into, or targeted, will be used.Include this field if you want to create a target in a different region other than the one you are connected.
The maximum length is 1000 characters. The minimum length is 3 characters.
--name TARGET_NAME-
The name to be given to the target.
The name must be 1000 characters or less, and cannot include any special characters other than (space),
-,.,_,:.The maximum length is 1000 characters. The minimum length is 1 character.
Do not include any personal identifying information (PII) in any resource names.
--destination-crn CLOUD_LOGS_TARGET_CRN-
The CRN of the IBM Cloud Logs instance.
The maximum length is 1000 characters. The minimum length is 3 characters.
--managed-by MANAGED-BY-
Identifies who manages this target.
If set to
enterprise, the target becomes enterprise-managed and can only be modified by identities authorized for the enterprise actions.If omitted or set to
account, the target is managed by the child account.This value is immutable after creation.
Valid values are:
enterprise,account. --output FORMAT-
Currently supported format is JSON. If specified, output will be returned in JSON format. If
JSONis not specified, output will be returned in a tabular format. help|--help|-h-
List options available for the command.
Example
The following is an example using the ibmcloud logs-router target create --name my-target --destination-crn crn:v1:bluemix:public:logs:global:a/xxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx:: --managed-by account command.
This example shows an example successful target creation.
Id 6f9137b3-2bb9-4724-851b-153e23c82d80
Name my-target
Destination Crn crn:v1:bluemix:public:logs:au-syd:a/xxxxxxxxxx:619801ea-7cd8-4792-80cf-49a8359b4357::
Target Type cloud_logs
Region eu-gb
Write Status
status success
Created At 2026-04-28T21:33:18.632Z
Updated At 2026-04-28T21:33:18.632Z
Managed By account
Updating a IBM Cloud Logs target using the CLI
Use this command to update an IBM Cloud Logs target for an IBM Cloud Logs Routing region.
Any specified value that is different from when the target was originally created will be updated to the value specified in the command.
ibmcloud logs-router target update --id TARGET [--name TARGET_NAME] --destination-crn CLOUD_LOGS_TARGET_CRN]]] [--output FORMAT]
where
--id TARGET-
The 4 UUID that uniquely identifies the target.
The maximum length is 1028 characters. The minimum length is 24 characters.
--name TARGET_NAME-
The name to be given to the target.
The name must be 1000 characters or less, and cannot include any special characters other than (space),
-,.,_,:'.The maximum length is 1000 characters. The minimum length is 1 character.
Do not include any personal identifying information (PII) in any resource names.
--destination-crn CLOUD_LOGS_TARGET_CRN-
The CRN of the IBM Cloud Logs instance.
--output FORMAT-
Currently supported format is JSON. If specified, output will be returned in JSON format. If
JSONis not specified, output will be returned in a tabular format. help|--help|-h-
List options available for the command.
Example
The following is an example using the ibmcloud logs-router target update --id 6f9137b3-2bb9-4724-851b-153e23c82d80 --name cl-platform-logs-sydney-113 command.
Id 6f9137b3-2bb9-4724-851b-153e23c82d80
Name cl-platform-logs-sydney-113
Destination Crn crn:v1:bluemix:public:logs:au-syd:a/xxxxxxxxxx:619801ea-7cd8-4792-80cf-49a8359b4357::
Target Type cloud_logs
Region eu-gb
Write Status
status success
Created At 2026-04-28T21:33:18.632Z
Updated At 2026-04-28T21:35:22.184Z
Managed By account
Deleting a target using the CLI
Use this command to delete a target.
ibmcloud logs-router target delete --id TARGET [--force]
where
--id TARGET-
The 4 UUID that uniquely identifies the target.
The maximum length is 1028 characters. The minimum length is 24 characters.
--force|-f-
Will delete the target without providing the user with any additional prompt.
help|--help|-h-
List options available for the command.
Example
The following is an example using the ibmcloud logs-router target delete --id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx command.
Are you sure you want to remove the target with target ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx? [y/N]>y
OK
Target with target ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx was successfully removed.
The following is an example using the ibmcloud logs-router target delete --id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -force command.
This example shows a failed command where the specified target could not be found.
Are you sure you want to remove the Target bearing Target ID 33333333-3333-3333-3333-333333333333? [y/N]> y
FAILED
Something went wrong. Error:
Status Code: 404
Incident ID: 67a33257-d5a4-46ec-94d9-14eb70e94f3d
Code: not_found
Message: The target id specified in `target_id` field is not found.
Validating and viewing details of a target by using the CLI
Use this command to get information about a target for an IBM Cloud Logs Routing region.
ibmcloud logs-router target get --id TARGET [--output FORMAT]
Where
--id TARGET-
The 4 UUID that uniquely identifies the target.
The maximum length is 1028 characters. The minimum length is 24 characters.
--output FORMAT-
Currently supported format is JSON. If specified, output will be returned in JSON format. If
JSONis not specified, output will be returned in a tabular format. help|--help|-h-
List options available for the command.
The response includes information about the status of the target in the write_status response object. This object includes the following information:
Write Statusinformation. Valid values are:successorfailed.Last Failuredate-time information of the timestamp of the last failure.Reason for last failureinformation with a detailed description of the cause of the failure.
Example
The following is an example using the ibmcloud logs-router target get --id new-target-name command showing an IBM Cloud Logs target.
Target
Name: new-target-name
ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
CRN: crn:v1:bluemix:public:atracker:us-south:a/xxxxxxxxxx
Type: cloud_logs
Cloud Logs Target CRN: crn:v1:bluemix:public:logs:global:a/xxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx:
Service to Service Enabled: true
Write Status: success
Created: 2024-06-02T16:04:15.174Z
Updated: 2024-06-05T17:49:56.452Z
Listing all targets in a region
Use this command to list the configured targets for an IBM Cloud Logs Routing region.
ibmcloud logs-router target list [--output FORMAT]
Where
--output FORMAT- Currently supported format is JSON. If specified, output will be returned in JSON format. If
JSONis not specified, output will be returned in a tabular format. help|--help|-h- List options available for the command.
Example
The following is an example using the ibmcloud logs-router target list command.
Name ID Region Type Created
target-01 xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx us-south cloud_logs 2020-11-18T03:52:08.603Z
API targets and actions
The following table lists the actions that you can run to manage targets:
| Action | REST API Method | API_URL |
|---|---|---|
| Create a target | POST |
<ENDPOINT>/v3/targets |
| Update a target | PATCH |
<ENDPOINT>/v3/targets/<TARGET_ID> |
| Delete a target | DELETE |
<ENDPOINT>/v3/targets/<TARGET_ID> |
| Read a target | GET |
<ENDPOINT>/v3/targets/<TARGET_ID> |
| List all targets | GET |
<ENDPOINT>/v3/targets |
| Validate a target | GET |
<ENDPOINT>/v3/targets |
You can use private and public endpoints to manage targets. For more information about the list of ENDPOINTS that are available, see Endpoints.
-
You can manage targets from the private network using an API endpoint with the following format:
https://private.REGION.logs-router.cloud.ibm.com -
You can manage targets from the public network using an API endpoint with the following format:
https://REGION.logs-router.cloud.ibm.com -
You can disable the public endpoints by updating the account settings. For more information, see Configuring target and region settings.
For more information about the REST API, see IBM Cloud Logs Routing REST API v3.
API prerequisites
To make API calls to manage targets, complete the following steps:
- Get an IAM access token. For more information, see Retrieving IAM access tokens.
- Identify the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.
Creating an IBM Cloud Logs target using the API
You can create a target to configure a destination where you can route platform logs.
- You can send your platform logs from all regions to a single target, different targets or multiple targets.
- You can define up to 16 targets per account.
- You can manage targets at enterprise level setting the
managed byparameter to enterprise. This value is immutable and cannot be changed after the target is created.
You can use the following cURL command to create a IBM Cloud Logs target:
curl -X POST <ENDPOINT>/v3/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json" -d '{
"name": "TARGET_NAME",
"destination_crn": "CLOUD_LOGS_CRN",
"region": "eu-gb",
"managed_by": "account"
}'
Where
<ENDPOINT>-
Endpoint is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.
TARGET_NAME-
The name to be given to the target.
The name must be 1000 characters or less, and cannot include any special characters other than (space),
-,.,_,:.The maximum length is 1000 characters. The minimum length is 1 character.
Do not include any personal identifying information (PII) in any resource names.
CLOUD_LOGS_TARGET_CRN-
The CRN of the IBM Cloud Logs instance.
The maximum length is 1000 characters. The minimum length is 3 characters.
REGION-
Name of the region, for example,
us-southoreu-gb. If not specified, the region logged into, or targeted, will be used.Include region if you want to create a target in a different region other than the one you are connected.
The maximum length is 1000 characters. The minimum length is 3 characters.
MANAGED-BY-
Identifies who manages this target.
If set to
enterprise, the target becomes enterprise-managed and can only be modified by identities authorized for the enterprise actions.If omitted or set to
account, the target is managed by the child account.This value is immutable after creation.
Valid values are:
enterprise,account.
For example, you can use the following cURL request to create a target in Dallas:
curl -X POST https://api.us-south.logs-router.cloud.ibm.com/v3/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json" -d '{
"name": "a-cloud-logs-target-us-south",
"destination_crn": "crn:v1:bluemix:public:logs:us-south:a/0be5ad401ae913d8ff665d92680664ed:22222222-2222-2222-2222-222222222222::"
}'
In the response, you get information about the target such as the id, that indicates the GUID of the target, and the crn, that indicates the CRN of the target.
Updating a IBM Cloud Logs target using the API
When you update an IBM Cloud Logs target, you must include the target information in the data section of the request.
- You must pass all fields.
- Update the fields that need to be changed.
You can use the following cURL command to update a target:
curl -X PATCH <ENDPOINT>/v3/targets/TARGET_ID -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json" -d '{
"name": "TARGET_NAME",
"destination_crn": "CLOUD_LOGS_CRN"
}'
Where
<ENDPOINT>-
Endpoint is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.
TARGET_ID-
The v4 UUID that uniquely identifies the target.
TARGET_NAME-
The name to be given to the target.
The name must be 1000 characters or less, and cannot include any special characters other than (space),
-,.,_,:.The maximum length is 1000 characters. The minimum length is 1 character.
Do not include any personal identifying information (PII) in any resource names.
CLOUD_LOGS_TARGET_CRN-
The CRN of the IBM Cloud Logs instance.
The maximum length is 1000 characters. The minimum length is 3 characters.
For example, you can use the following cURL request to update a target in Dallas:
curl -X PATCH https://api.us-south.logs-router.cloud.ibm.com/v3/targets/TARGET_ID -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json" -d '{
"name": "a-cloud-logs-target-modified",
"destination_crn": "crn:v1:bluemix:public:logs:us-south:a/0be5ad401ae913d8ff665d92680664ed:33333333-3333-3333-3333-333333333333::"
}'
Deleting a target using the API
You can use the following cURL command to delete a target:
curl -X DELETE <ENDPOINT>/v3/targets/<TARGET_ID> -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"
Where
<ENDPOINT>is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.<TARGET_ID>is the v4 UUID that uniquely identifies the target.
For example, you can use the following cURL request to delete a target in US-South with the ID 00000000-0000-0000-0000-000000000000:
curl -X DELETE https://api.us-south.logs-router.cloud.ibm.com/v3/targets/00000000-0000-0000-0000-000000000000 -H "Authorization: Bearer <IAM_TOKEN> -H "content-type: application/json""
In the response, you get an empty result if the deletion was successful:
{}
Validating and viewing details of a target by using the API
You can use the following cURL command to view the configuration details of 1 target:
curl -X GET <ENDPOINT>/v3/targets/<TARGET_ID> -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"
Where
<ENDPOINT>is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.<TARGET_ID>is the v4 UUID that uniquely identifies the target.
The response includes information about the status of the target in the write_status response object. This object includes the following information:
statusinformation. Valid values are:successorfailed.last_failuredate-time information of the timestamp of the last failure.reason_for_last_failureinformation with a detailed description of the cause of the failure.
For example, you can run the following cURL request to get information about a target with the ID 00000000-0000-0000-0000-000000000000:
curl -X GET https://api.us-south.logs-router.cloud.ibm.com/v3/targets/00000000-0000-0000-0000-000000000000 -H "Authorization: Bearer <IAM_TOKEN> -H "content-type: application/json""
The response looks as follows:
{
"name": "cloud-logs-target",
"id": "00000000-0000-0000-0000-000000000000",
"crn": "crn:v1:bluemix:public:logs-router:us-south:a/4329073d16d2f3663f74bfa955259139::target:00000000-0000-0000-0000-000000000000",
"destination_crn": "crn:v1:bluemix:public:logs:us-south:a/0be5ad401ae913d8ff665d92680664ed:22222222-2222-2222-2222-222222222222::",
"target_type": "cloud_logs",
"write_status": {
"status": "success"
},
"created_at": "2026-02-01T19:39:38.174Z",
"updated_at": "2026-02-01T19:39:38.174Z",
"managed_by": "enterprise"
}
Listing all targets using the API
You can use the following cURL command to view all targets:
curl -X GET <ENDPOINT>/v3/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"
Where
<ENDPOINT>is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.
For example, you can run the following cURL request to get information about the targets that are defined in Dallas:
curl -X GET https://private.us-south.logs-router.cloud.ibm.com/v3/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"
HTTP response codes
When you use the IBM Cloud Logs Routing REST API, you can get standard HTTP response codes to indicate whether a method completed successfully.
- A 200 response always indicates success.
- A 4xx response indicates a failure.
- A 5xx response usually indicates an internal system error.
See the following table for some HTTP response codes:
| Status code | Status | Description |
|---|---|---|
200 |
OK | A list of targets were successfully retrieved. |
201 |
OK | The request was successful. A resource is created. |
400 |
Bad Request | The request was unsuccessful. You might be missing a parameter that is required. |
401 |
Unauthorized | The IAM token that is used in the API request is invalid or expired. |
403 |
Forbidden | The operation is forbidden due to insufficient permissions. |
404 |
Not Found | The requested resource doesn't exist or is already deleted. |
409 |
Conflict | There is a conflict with the request data and the state of resources in system. |
429 |
Too Many Requests | Too many requests hit the API too quickly. |
500 |
Internal Server Error | Something went wrong. Your request could not be processed. Try again later. If the problem persists, note the transaction-id in the response header and contact IBM Cloud support. |
Creating a IBM Cloud Logs target using the UI
Only resources in your account are listed and selectable. To specify a resource in a different account, select Specify CRN under Choose destination.
Complete the following steps to create a target:
-
Click the Menu icon
> Observability.
-
Select Logging > Routing.
-
In the Targets section, click Create to open the create panel.
-
In the Choose destination, pick Search by instance or Specify CRN.
Select Search by instance to choose an IBM Cloud Logs instance from the table that is available in the account
Select Specify CRN to add the IBM Cloud Logs instance CRN of an instance that is located in a different account.
A service authorization is required to allow IBM Cloud Logs Routing to communicate with IBM Cloud Logs.
-
In the target details section, complete the following tasks:
Enter the target name.
Enable the toggle from Not set to automatically set your new target as a default target in your IBM Cloud Logs Routing settings.
-
Click Create target.
Updating a IBM Cloud Logs target using the UI
Only resources in your account are listed and selectable. To specify a resource in a different account, select Specify CRN under Choose destination.
Complete the following steps:
- Log in to your IBM Cloud account.
- Click the Menu icon
> Observability.
- Select Logging > Routing.
- In the Targets section, determine which target to update and click the
.
- Click Edit to open the update panel.
- In the Update panel, click Edit to update your target's name, CRN to change the IBM Cloud Logs instance associated with your target, or both. You can also toggle Default target to add or remove your target as a default target in your IBM Cloud Logs Routing settings.
- Click Save to update your target.
Deleting a target using the UI
You cannot delete an IBM Cloud Logs Routing target if it is used in a route or as a default target setting.
- Log in to your IBM Cloud account.
- Click the Menu icon
> Observability.
- Select Logging > Routing.
- In the Targets section, determine which target to update and click the
.
- Select Delete and then click Delete in the confirmation panel.
Listing all targets in a region using the UI
- Log in to your IBM Cloud account.
- Click the Menu icon
> Observability.
- Select Logging > Routing.
You can see the list of targets that are defined in the account. The following information is included per target:
-
Target name
-
Target type
-
Destination name
-
Destination region
-
Routes define if the target is used in any routes.
-
Target status:
- Configured: The target is working as expected.
- Not receiving: The target is miscosfigured and events will not be routed to the destination. Update your target details or destination to fix the target configuration or delete the target if it is no longer needed.