XpoLog search API
Run a search from a URL and get XML or CSV back — the searchAPI call with its time frames, pagination, limits and error codes — export a dashboard as PDF, open the Search console on a query, and use the datastream function as a volume feed.
What you will do: run a search over HTTP/S from a script and read the rows back as CSV or XML.
The product's URL-based API lives on your deployment under the /logeye context — port 30303 or 30443 on V7, the ui role's port or the Traefik edge on X8. When security is active, every call must sign in: append &autoLogin=true&username=<user>&password=<password> to the URL. That is the only mechanism the wiki documents for the URL API (no token or API key on the product side — pending engineering), so keep calls on HTTPS, give scripts a dedicated user with a View-Only policy (Policies), and prefer the SDK or a reverse proxy for anything exposed beyond the console.
Search
GET /logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=<query>&fixedInterval=<interval>
&startTimeFullStr=<start>&endTimeFullStr=<end>&maxNumOfRecords=<n>&resultFormat=xml|csv
&paginate=true|false&token=<token>&maxRecordsPerPage=<n>&timeout=<ms>&abortOn=<n>
| Parameter | Meaning |
|---|---|
searchQuery | A query in the search language, as typed in the Search console (URL-encode it); see Search language reference |
fixedInterval | One of last15Minutes, last30Minutes, last60Minutes, last3Hours, last12Hours, last24Hours, last7Days, last14Days, last1Months, last6Months, currentDay, previousDay, currentWeek, previousWeek, allData — exactly as listed; not together with the explicit times |
startTimeFullStr, endTimeFullStr | Both, in the system's date format (default MM/dd/yyyy HH:mm:ss), only when fixedInterval is absent |
maxNumOfRecords | Maximum rows in the result; default from the system property widgets.searchAPI.maxNumOfRecords (100 unless changed) |
resultFormat | xml or csv, lower case |
paginate | true returns a token for the execution and the first page |
token | The token from the first paginated call; each further call with it returns the next page — forward only |
maxRecordsPerPage | Rows per page; default 100 |
timeout | Milliseconds the query may run; beyond it the search stops with error 3 |
abortOn | Maximum number of results; beyond it the search stops with error 2 |
The response is an XML document:
<APIResult>
<Status state="OK|Fail" token="<execution token or empty>" numberOfResults="<n>">
<Url><!-- when OK: the file that holds the result --></Url>
<Message><!-- when Fail --></Message>
</Status>
<Data><!-- the rows; CSV is wrapped in CDATA --></Data>
</APIResult>
Data carries the rows unless the result is larger than the system-configured limit; then it is empty and Url points at the result file to download. Failures carry one of:
| Code | Meaning |
|---|---|
| 1 | Internal error — retry, then contact support |
| 2 | Results exceed the allowed threshold (abortOn or the system limit) |
| 3 | Request timeout |
| 4 | Request cancelled |
| 5 | Resources exceeded — the search could not run with the available resources |
Examples (replace host, port, log and app names):
/logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=error%20or%20fail*%20in%20log.log4j*&startTimeFullStr=01/01/2026%2000:00:00&endTimeFullStr=02/02/2026%2000:00:00&maxNumOfRecords=1000&resultFormat=csv /logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=error%20or%20exception&fixedInterval=last7Days&maxNumOfRecords=1000&resultFormat=xml /logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=*%20in%20app.Windows%20Event%20Logs%20|%20count%20|%20group%20by%20event&fixedInterval=last7Days&resultFormat=csv&autoLogin=true&username=<user>&password=<password>
Dashboard as PDF
GET /logeye/view/api/dashboardAPI.jsp?action=export&appName=<App>&viewName=<Dashboard>
Returns the latest result of the dashboard as a PDF; app and dashboard names are case-insensitive. The same export exists in the console — see Saved searches and export.
Open the Search console on a query
GET /logeye/search/view/loadSearchModel.jsp?searchQuery=<query>&fixedInterval=<interval> GET /logeye/search/view/loadSearchModel.jsp?searchQuery=<query>&startTimeFullStr=<start>&endTimeFullStr=<end>
Opens the Search console with the query executed — the link to put behind a dashboard, a ticket or a monitor alert.
A volume feed
The datastream search function returns the number of events and the volume in bytes collected for the selected period, per source when grouped; through the search API it is the product-side feed of what was ingested:
* | datastream | group by ext.log, ext.folder, ext.server | order by data volume desc | display data volume in volume format
Per folder or AppTag, the collectedDataInfo call on the Configuration API gives the counts of defined and collected logs. dock's own usage meters arrive with the heartbeat — see Usage (sign in to read).
Rate limits for the URL API are not documented — pending engineering; size the calls with maxNumOfRecords, timeout and abortOn.
Next: PortX ingest HTTP API
Source: XPLG wiki, pages 1594753063, 1597014014, 1602584807, 1594130424, 1594130411 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594753063). Pending from XPLG engineering: a token or API key for the product URL API; rate limits.
