Configuration API
Read the Folders and Logs tree and each log's definition over HTTP/S with the restapi endpoints, read collection statistics per folder or AppTag with collectedDataInfo, and know that configuration writes go through the SDK.
What you will do: read the configuration of a deployment from a script — the tree, every log's patterns, policy and paths, what was collected — and change it with the SDK.
The read endpoints are part of the product's URL API under /logeye and authenticate like the search API: &autoLogin=true&username=<user>&password=<password> when security is active, on HTTPS, with a dedicated read-only user (see XpoLog search API). Folder paths use -> between levels (URL-encoded -%3E) and names are case-sensitive. The restapi responses share one envelope: {"success": true|false, "errorMessage": null|"…", "response": …, "httpStatusCode": 0}.
The Folders and Logs tree
GET /logeye/restapi/folders-and-logs-configuration?sourceQuery=apptag.<AppTag> GET /logeye/restapi/folders-and-logs-configuration?sourceQuery=folder.<Folder>
sourceQuery selects the part of the tree to return (one or more folders or AppTags, as in a search). The response is the tree: each node has id, name, description, type (Module for a folder, Log), hasChildrens and children.
One log
GET /logeye/restapi/log-configuration?logPath=ROOT-%3E<Folder>-%3E<Sub folder>&logName=<Log>
| Field | Meaning |
|---|---|
type, id, name, description | The log's identity |
path | Its place in the Folders and Logs tree |
appTags | The AppTags it is tagged to |
collectionPolicy | The name of its collection policy |
patterns | The data patterns applied — see Parse |
filePaths | The files it reads, several locations separated by @#@# |
accountName | The Address Book account used, when the source is remote |
charSet, timeZone | Regional settings |
dataFilterQuery | The filter applied at collection, when any |
Many logs
GET /logeye/restapi/logs-configuration?sourceQuery=folder.<Folder>
Returns the complete details of every log matched by the source query as pipe-delimited rows with the same fields (type, id, name, description, path, appTags, collection policy, patterns, files paths, account name, char set, time zone, data filter query). The wiki gives a pattern to parse that output as a log in XPLG itself:
{text:type} | {text:id} | {text:name} | {text:description} | {text:path} | {text:appTags} | {text:collection policy} | {string:patterns} | {string:files paths} | {text:account name} | {text:char set} | {text:time zone} | {text:data Filter Query}
Collection statistics
GET /logeye/message/messageJsonApi.jsp?api=collectedDataInfo&type=AppTags|Folders&timeFrame=<interval>&detailsLevel=Basic|Detailed&maxNumberOfResults=<n>
| Parameter | Meaning |
|---|---|
type | Folders (default) or AppTags |
timeFrame | The same fixed intervals as the search API; default last24Hours |
detailsLevel | Basic: per folder or AppTag the number of defined logs and of logs that collected data in the time frame. Detailed: adds unCollectedLogsData, the logs that did not collect, each with its full path (comma-separated) and dataSize in bytes |
maxNumberOfResults | For Detailed; default 100 |
The response is {"data": {"collectionData": [{"Folders"|"AppTags": "<name>", "totalLogs": n, "collectedLogs": n, "unCollectedLogsData": [...]}]}}. It is the quickest way to find sources that went quiet; the volume per source comes from the datastream search function on the search API.
Writing configuration
The wiki documents no REST write endpoints. Configuration changes from scripts go through the SDK: accounts, scan and Log Sync tasks, folders and logs (including Windows Event Logs), AppTag time zones, security users, ports and modes, the license, a restart and patches — see SDK and CLI reference. Single objects can also be exported and imported from the console — see Backup and restore.
Next: SDK and CLI reference
Source: XPLG wiki, pages 1594753063, 1597014014, 1597014018, 1602584807 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594753063).
