How do I manage IBM Cloud Logs targets in IBM Cloud Logs Routing

You can manage IBM Cloud Logs targets in your account by using the IBM Cloud Logs Routing UI, the IBM Cloud Logs Routing CLI, the IBM Cloud Logs Routing REST API, and Terraform scripts. A target is a resource where you can collect platform logs.

For more information on IBM Cloud Logs Routing targets, see Targets.

What IAM permissions do I need to manage IBM Cloud Logs targets in IBM Cloud Logs Routing

You must grant users IAM permissions to manage targets. For more information, see Assign access to resources.

When you define a policy, you can indicate the scope of the permissions. You can choose from granting permissions for a specific region or for the entire account.

If you have the IAM permission to create policies and authorizations, you can grant only the level of access that you have as a user of the target service. For example, if you have viewer access for the target service, you can assign only the viewer role for the authorization. If you attempt to assign a higher permission such as administrator, it might appear that permission is granted, however, only the highest level permission you have for the target service, that is viewer, will be assigned.

Users with regional scope will be limited to access targets in their authorized region.

IAM actions and the IAM roles that include them.
IAM action IAM Policy scope IAM Roles Description
logs-router.target.read Region Administrator
Editor
Viewer
Operator		 Read (view) information about a target
logs-router.target.create Region Administrator
Editor		 Create a target
logs-router.target.update Region Administrator
Editor		 Update a target
logs-router.target.delete Region Administrator
Editor		 Delete a target
logs-router.target.list Account Administrator
Editor
Viewer
Operator		 List all targets

How do I configure an IAM service-to-service (S2S) authorization between IBM® Cloud Logs Routing and IBM Cloud Logs

When writing to an IBM Cloud Logs target, you must configure a service-to-service (S2S) authorization between IBM Cloud Logs Routing and IBM Cloud Logs.

Choose 1 of the following options:

What are the CLI prerequisites to work with targets in IBM Cloud Logs Routing through the command line

Before you use the CLI to manage targets, complete the following steps:

  1. Install the IBM Cloud CLI.

  2. Install the IBM Cloud Logs Routing CLI.

  3. Log in to IBM Cloud. Run the following command: ibmcloud login

Creating an IBM Cloud Logs target in IBM Cloud Logs Routing using the CLI

Use this command to create a IBM Cloud Logs target:

 ibmcloud logs-router target create --name TARGET_NAME  --destination-crn CLOUD_LOGS_TARGET_CRN [--region REGION] [--managed-by MANAGED-BY] [--output FORMAT]

Where

--region REGION | -r REGION

Name of the region, for example, us-south or eu-gb. If not specified, the region logged into, or targeted, will be used.

Include this field if you want to create a target in a different region other than the one you are connected.

The maximum length is 1000 characters. The minimum length is 3 characters.

--name TARGET_NAME

The name to be given to the target.

The name must be 1000 characters or less, and cannot include any special characters other than (space), -, ., _, :.

The maximum length is 1000 characters. The minimum length is 1 character.

Do not include any personal identifying information (PII) in any resource names.

--destination-crn CLOUD_LOGS_TARGET_CRN

The CRN of the IBM Cloud Logs instance.

The maximum length is 1000 characters. The minimum length is 3 characters.

--managed-by MANAGED-BY

Identifies who manages this target.

If set to enterprise, the target becomes enterprise-managed and can only be modified by identities authorized for the enterprise actions.

If omitted or set to account, the target is managed by the child account.

This value is immutable after creation.

Valid values are: enterprise, account.

--output FORMAT

Currently supported format is JSON. If specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

help | --help | -h

List options available for the command.

Example

The following is an example using the ibmcloud logs-router target create --name my-target --destination-crn crn:v1:bluemix:public:logs:global:a/xxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx:: --managed-by account command.

This example shows an example successful target creation.

Id                6f9137b3-2bb9-4724-851b-153e23c82d80
Name              my-target
Destination Crn   crn:v1:bluemix:public:logs:au-syd:a/xxxxxxxxxx:619801ea-7cd8-4792-80cf-49a8359b4357::
Target Type       cloud_logs
Region            eu-gb
Write Status
                  status   success

Created At        2026-04-28T21:33:18.632Z
Updated At        2026-04-28T21:33:18.632Z
Managed By        account

Updating an IBM Cloud Logs target in IBM Cloud Logs Routing using the CLI

Use this command to update an IBM Cloud Logs target for an IBM Cloud Logs Routing region.

Any specified value that is different from when the target was originally created will be updated to the value specified in the command.

ibmcloud logs-router target update --id TARGET [--name TARGET_NAME] --destination-crn CLOUD_LOGS_TARGET_CRN]]] [--output FORMAT]

where

--id TARGET

The 4 UUID that uniquely identifies the target.

The maximum length is 1028 characters. The minimum length is 24 characters.

--name TARGET_NAME

The name to be given to the target.

The name must be 1000 characters or less, and cannot include any special characters other than (space), -, ., _, :'.

The maximum length is 1000 characters. The minimum length is 1 character.

Do not include any personal identifying information (PII) in any resource names.

--destination-crn CLOUD_LOGS_TARGET_CRN

The CRN of the IBM Cloud Logs instance.

--output FORMAT

Currently supported format is JSON. If specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

help | --help | -h

List options available for the command.

Example

The following is an example using the ibmcloud logs-router target update --id 6f9137b3-2bb9-4724-851b-153e23c82d80 --name cl-platform-logs-sydney-113 command.

Id                6f9137b3-2bb9-4724-851b-153e23c82d80
Name              cl-platform-logs-sydney-113
Destination Crn   crn:v1:bluemix:public:logs:au-syd:a/xxxxxxxxxx:619801ea-7cd8-4792-80cf-49a8359b4357::
Target Type       cloud_logs
Region            eu-gb
Write Status
                  status   success

Created At        2026-04-28T21:33:18.632Z
Updated At        2026-04-28T21:35:22.184Z
Managed By        account

Deleting an IBM Cloud Logs target in IBM Cloud Logs Routing using the CLI

Use this command to delete a target.

ibmcloud logs-router target delete --id TARGET [--force]

where

--id TARGET

The 4 UUID that uniquely identifies the target.

The maximum length is 1028 characters. The minimum length is 24 characters.

--force | -f

Will delete the target without providing the user with any additional prompt.

help | --help | -h

List options available for the command.

Example

The following is an example using the ibmcloud logs-router target delete --id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx command.

Are you sure you want to remove the target with target ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx? [y/N]>y
OK
Target with target ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx was successfully removed.

The following is an example using the ibmcloud logs-router target delete --id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -force command.

This example shows a failed command where the specified target could not be found.

Are you sure you want to remove the Target bearing Target ID 33333333-3333-3333-3333-333333333333? [y/N]> y
FAILED
Something went wrong. Error:
 Status Code:  404
 Incident ID:  67a33257-d5a4-46ec-94d9-14eb70e94f3d
 Code:         not_found
 Message:      The target id specified in `target_id` field is not found.

Validating and viewing details of an IBM Cloud Logs target in IBM Cloud Logs Routing by using the CLI

Use this command to get information about a target for an IBM Cloud Logs Routing region.

ibmcloud logs-router target get --id TARGET [--output FORMAT]

Where

--id TARGET

The 4 UUID that uniquely identifies the target.

The maximum length is 1028 characters. The minimum length is 24 characters.

--output FORMAT

Currently supported format is JSON. If specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

help | --help | -h

List options available for the command.

The response includes information about the status of the target in the write_status response object. This object includes the following information:

  • Write Status information. Valid values are: success or failed.
  • Last Failure date-time information of the timestamp of the last failure.
  • Reason for last failure information with a detailed description of the cause of the failure.

Example

The following is an example using the ibmcloud logs-router target get --id new-target-name command showing an IBM Cloud Logs target.

Target
Name:                       new-target-name
ID:                         xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
CRN:                        crn:v1:bluemix:public:atracker:us-south:a/xxxxxxxxxx
Type:                       cloud_logs
Cloud Logs Target CRN:      crn:v1:bluemix:public:logs:global:a/xxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx:
Service to Service Enabled: true
Write Status:               success
Created:                    2024-06-02T16:04:15.174Z
Updated:                    2024-06-05T17:49:56.452Z

Listing all targets in IBM Cloud Logs Routing in a region by using the CLI

Use this command to list the configured targets for an IBM Cloud Logs Routing region.

ibmcloud logs-router target list [--output FORMAT]

Where

--output FORMAT
Currently supported format is JSON. If specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.
help | --help | -h
List options available for the command.

Example

The following is an example using the ibmcloud logs-router target list command.

Name                       ID                                     Region     Type                Created
target-01                  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx   us-south   cloud_logs          2020-11-18T03:52:08.603Z

What are the API prerequisites to work with targets in IBM Cloud Logs Routing

To make API calls to manage targets, complete the following steps:

  1. Get an IAM access token. For more information, see Retrieving IAM access tokens.
  2. Identify the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.

Creating an IBM Cloud Logs target in IBM Cloud Logs Routing using the API

You can create a target to configure a destination where you can route platform logs.

  • You can send your platform logs from all regions to a single target, different targets or multiple targets.
  • You can define up to 16 targets per account.
  • You can manage targets at enterprise level setting the managed by parameter to enterprise. This value is immutable and cannot be changed after the target is created.

You can use the following cURL command to create a IBM Cloud Logs target:

curl -X POST  <ENDPOINT>/v3/targets   -H "Authorization:  $ACCESS_TOKEN"   -H "content-type: application/json"   -d '{
    "name": "TARGET_NAME",
    "destination_crn": "CLOUD_LOGS_CRN",
    "region": "eu-gb",
    "managed_by": "account"
  }'

Where

<ENDPOINT>

Endpoint is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.

TARGET_NAME

The name to be given to the target.

The name must be 1000 characters or less, and cannot include any special characters other than (space), -, ., _, :.

The maximum length is 1000 characters. The minimum length is 1 character.

Do not include any personal identifying information (PII) in any resource names.

CLOUD_LOGS_TARGET_CRN

The CRN of the IBM Cloud Logs instance.

The maximum length is 1000 characters. The minimum length is 3 characters.

REGION

Name of the region, for example, us-south or eu-gb. If not specified, the region logged into, or targeted, will be used.

Include region if you want to create a target in a different region other than the one you are connected.

The maximum length is 1000 characters. The minimum length is 3 characters.

MANAGED-BY

Identifies who manages this target.

If set to enterprise, the target becomes enterprise-managed and can only be modified by identities authorized for the enterprise actions.

If omitted or set to account, the target is managed by the child account.

This value is immutable after creation.

Valid values are: enterprise, account.

For example, you can use the following cURL request to create a target in Dallas:

curl -X POST   https://api.us-south.logs-router.cloud.ibm.com/v3/targets   -H "Authorization: $ACCESS_TOKEN"   -H "content-type: application/json"   -d '{
    "name": "a-cloud-logs-target-us-south",
    "destination_crn": "crn:v1:bluemix:public:logs:us-south:a/0be5ad401ae913d8ff665d92680664ed:22222222-2222-2222-2222-222222222222::"
  }'

In the response, you get information about the target such as the id, that indicates the GUID of the target, and the crn, that indicates the CRN of the target.

Updating an IBM Cloud Logs target in IBM Cloud Logs Routing using the API

When you update an IBM Cloud Logs target, you must include the target information in the data section of the request.

  • You must pass all fields.
  • Update the fields that need to be changed.

You can use the following cURL command to update a target:

curl -X PATCH  <ENDPOINT>/v3/targets/TARGET_ID  -H "Authorization:  $ACCESS_TOKEN"   -H "content-type: application/json"   -d '{
    "name": "TARGET_NAME",
    "destination_crn": "CLOUD_LOGS_CRN"
  }'

Where

<ENDPOINT>

Endpoint is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.

TARGET_ID

The v4 UUID that uniquely identifies the target.

TARGET_NAME

The name to be given to the target.

The name must be 1000 characters or less, and cannot include any special characters other than (space), -, ., _, :.

The maximum length is 1000 characters. The minimum length is 1 character.

Do not include any personal identifying information (PII) in any resource names.

CLOUD_LOGS_TARGET_CRN

The CRN of the IBM Cloud Logs instance.

The maximum length is 1000 characters. The minimum length is 3 characters.

For example, you can use the following cURL request to update a target in Dallas:

curl -X PATCH   https://api.us-south.logs-router.cloud.ibm.com/v3/targets/TARGET_ID   -H "Authorization: $ACCESS_TOKEN"   -H "content-type: application/json"   -d '{
    "name": "a-cloud-logs-target-modified",
    "destination_crn": "crn:v1:bluemix:public:logs:us-south:a/0be5ad401ae913d8ff665d92680664ed:33333333-3333-3333-3333-333333333333::"
  }'

Deleting an IBM Cloud Logs target in IBM Cloud Logs Routing using the API

You can use the following cURL command to delete a target:

curl -X DELETE <ENDPOINT>/v3/targets/<TARGET_ID> -H "Authorization:  $ACCESS_TOKEN" -H "content-type: application/json"

Where

  • <ENDPOINT> is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.
  • <TARGET_ID> is the v4 UUID that uniquely identifies the target.

For example, you can use the following cURL request to delete a target in US-South with the ID 00000000-0000-0000-0000-000000000000:

curl -X DELETE https://api.us-south.logs-router.cloud.ibm.com/v3/targets/00000000-0000-0000-0000-000000000000 -H "Authorization: Bearer <IAM_TOKEN> -H "content-type: application/json""

In the response, you get an empty result if the deletion was successful:

{}

Validating and viewing details of an IBM Cloud Logs target in IBM Cloud Logs Routing by using the API

You can use the following cURL command to view the configuration details of 1 target:

curl -X GET <ENDPOINT>/v3/targets/<TARGET_ID> -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"

Where

  • <ENDPOINT> is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.
  • <TARGET_ID> is the v4 UUID that uniquely identifies the target.

The response includes information about the status of the target in the write_status response object. This object includes the following information:

  • status information. Valid values are: success or failed.
  • last_failure date-time information of the timestamp of the last failure.
  • reason_for_last_failure information with a detailed description of the cause of the failure.

For example, you can run the following cURL request to get information about a target with the ID 00000000-0000-0000-0000-000000000000:

curl -X GET https://api.us-south.logs-router.cloud.ibm.com/v3/targets/00000000-0000-0000-0000-000000000000 -H "Authorization: Bearer <IAM_TOKEN> -H "content-type: application/json""

The response looks as follows:

{
  "name": "cloud-logs-target",
  "id": "00000000-0000-0000-0000-000000000000",
  "crn": "crn:v1:bluemix:public:logs-router:us-south:a/4329073d16d2f3663f74bfa955259139::target:00000000-0000-0000-0000-000000000000",
  "destination_crn": "crn:v1:bluemix:public:logs:us-south:a/0be5ad401ae913d8ff665d92680664ed:22222222-2222-2222-2222-222222222222::",
  "target_type": "cloud_logs",
  "write_status": {
    "status": "success"
  },
  "created_at": "2026-02-01T19:39:38.174Z",
  "updated_at": "2026-02-01T19:39:38.174Z",
  "managed_by": "enterprise"
}

Listing all targets in IBM Cloud Logs Routing using the API

You can use the following cURL command to view all targets:

curl -X GET <ENDPOINT>/v3/targets -H "Authorization: $ACCESS_TOKEN" -H "content-type: application/json"

Where

  • <ENDPOINT> is the API endpoint in the region where you plan to configure or manage a target. For more information, see Endpoints.

For example, you can run the following cURL request to get information about the targets that are defined in Dallas:

curl -X GET https://private.us-south.logs-router.cloud.ibm.com/v3/targets -H "Authorization:  $ACCESS_TOKEN" -H "content-type: application/json"

Creating an IBM Cloud Logs target in IBM Cloud Logs Routing using the UI

Only resources in your account are listed and selectable. To specify a resource in a different account, select Specify CRN under Choose destination.

Complete the following steps to create a target:

  1. Log in to your IBM Cloud account.

  2. Click the Menu icon Menu icon > Observability.

  3. Select Logging > Routing.

  4. In the Targets section, click Create to open the create panel.

  5. In the Choose destination, pick Search by instance or Specify CRN.

    Select Search by instance to choose an IBM Cloud Logs instance from the table that is available in the account

    Select Specify CRN to add the IBM Cloud Logs instance CRN of an instance that is located in a different account.

    A service authorization is required to allow IBM Cloud Logs Routing to communicate with IBM Cloud Logs.

  6. In the target details section, complete the following tasks:

    Enter the target name.

    Enable the toggle from Not set to automatically set your new target as a default target in your IBM Cloud Logs Routing settings.

  7. Click Create target.

Updating an IBM Cloud Logs target in IBM Cloud Logs Routing using the UI

Only resources in your account are listed and selectable. To specify a resource in a different account, select Specify CRN under Choose destination.

Complete the following steps:

  1. Log in to your IBM Cloud account.
  2. Click the Menu icon Menu icon > Observability.
  3. Select Logging > Routing.
  4. In the Targets section, determine which target to update and click the Actions icon.
  5. Click Edit to open the update panel.
  6. In the Update panel, click Edit to update your target's name, CRN to change the IBM Cloud Logs instance associated with your target, or both. You can also toggle Default target to add or remove your target as a default target in your IBM Cloud Logs Routing settings.
  7. Click Save to update your target.

Deleting an IBM Cloud Logs target in IBM Cloud Logs Routing using the UI

You cannot delete an IBM Cloud Logs Routing target if it is used in a route or as a default target setting.

  1. Log in to your IBM Cloud account.
  2. Click the Menu icon Menu icon > Observability.
  3. Select Logging > Routing.
  4. In the Targets section, determine which target to update and click the Actions icon.
  5. Select Delete and then click Delete in the confirmation panel.

Listing all targets in IBM Cloud Logs Routing in a region using the UI

  1. Log in to your IBM Cloud account.
  2. Click the Menu icon Menu icon > Observability.
  3. Select Logging > Routing.

You can see the list of targets that are defined in the account. The following information is included per target:

  • Target name

  • Target type

  • Destination name

  • Destination region

  • Routes define if the target is used in any routes.

  • Target status:

    • Configured: The target is working as expected.
    • Not receiving: The target is miscosfigured and events will not be routed to the destination. Update your target details or destination to fix the target configuration or delete the target if it is no longer needed.