Product API and SDK

The XPLG product's own API under /logeye — search, dashboard export, collected-data information, configuration — and the xpologClient.jar SDK for remote configuration, licenses and patches.

What you will do: query the XPLG product and configure it remotely, separately from dock's API.

The product exposes a URL-based read API and a Java SDK client. Both live on your deployment, under the /logeye context (HTTP 30303 or HTTPS 30443 on V7; the ui role's port or the Traefik edge on X8). When security is on, the legacy API authenticates with credentials in the query string — keep API calls on HTTPS and prefer the SDK or a reverse proxy for anything exposed beyond the console.

API

  • Search — GET /logeye/view/api/widgetAPI.jsp?widgetId=searchAPI with searchQuery (the search language), either fixedInterval (last24Hours, last7Days, currentDay, …) or startTimeFullStr/endTimeFullStr, resultFormat=xml|csv, maxNumOfRecords, paginate with a forward-only token, timeout and abortOn. The XML response carries Status (OK or Fail, a token, the count), Data (CSV in CDATA) or a Url to a file for large results; error codes 1 internal, 2 results exceed the threshold, 3 timeout, 4 cancelled, 5 resources exceeded.
  • Dashboard export — GET /logeye/view/api/dashboardAPI.jsp?action=export&appName=<App>&viewName=<Dashboard> returns the latest dashboard as PDF.
  • Open the Search console on a query — GET /logeye/search/view/loadSearchModel.jsp?searchQuery=…&fixedInterval=….
  • Collected-data information — GET /logeye/message/messageJsonApi.jsp?api=collectedDataInfo&type=AppTags|Folders&timeFrame=…&detailsLevel=Basic|Detailed returns total and collected logs per AppTag or folder (the closest thing to a usage feed on the product side).
  • Configuration — GET /logeye/restapi/folders-and-logs-configuration?sourceQuery=…, GET /logeye/restapi/log-configuration?logPath=…&logName=…, GET /logeye/restapi/logs-configuration?sourceQuery=… return the Folders and Logs tree and log definitions (patterns, policy, paths, account, charset, time zone, filter).
  • Ingest — POST /logeye/api/logger.jsp?token=<listener token>&hostName=<source> with {"message": …} is the HTTP/S listener every shipper uses; see Sources.

SDK

xpologClient.jar runs anywhere with a Java runtime and HTTP/S access to the server (a .keystore beside the jar for HTTPS):

java -cp xpologClient.jar com.xpolog.sdk.client.XpoLogSDKClient \
  -xpologURL https://<host>:30443/logeye -user <user> -password <password> -api <command> ...

Commands: settings (ports, security on/off, Agent Mode, time-zone mode), securityUsers, addSSHAccount, addRemoteXpoLogAccount, addExternalAccount (S3), addScanTask / executeScanTask (Add Logs Directory with a cron), addSyncLogTask (LogSync, with assignedNode in a cluster), addLog (including Windows Event Logs by unc), addFolder, removeMember, license -files license.lic (apply a license file), addPatch -type api -files patch.zip and restart. Typical uses: onboarding servers in dynamic environments (add an account and a scan task), decommissioning while keeping data (disable the account), and mass rollout with silent installs.

Next: Administration

Source: XPLG wiki, pages 1597014014, 1594753063, 1597014018, 1598685520 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1597014018).