XpoLog API

Security

In case security is activated in XpoLog (login is required) then using the URL based API will require passing user's credentials in order to login into the system prior to executing the API command.
It is required to pass the username and password in the URL to XpoLog in order to get the command executed.

Add to each link at the end: 
&autoLogin=true&username=[USER_NAME]&password=[PASSWORD]

[USER_NAME] = the user name which the API will use to login  
[PASSWORD] =  the password of the user name

 

URL that returns events from XpoLog Search in XML/CSV format

1. http://[MACHINE_NAME]:[XPOLOG_PORT]/logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=[see item 2]&fixedInterval=[see item 3]&startTimeFullStr=[see item 4]&endTimeFullStr=[see item 4]&maxNumOfRecords=[see item 5]&resultFormat=[see item 6]&paginate=[see item 7]&token=[see item 7.a]&maxRecordsPerPage=[see item 8]&timeout=[see item 9]&abortOn=[see item 10]
2. searchQuery=a query as used in XpoSearch console
3. fixedInterval=optional values are: last15Minutes, last30Minutes, last60Minutes, last3Hours, last12Hours, last24Hours, last7Days, last14Days, last1Months, last6Months, currentDay, previousDay, currentWeek, previousWeek, allData
   IMPORTANT: when using fixedInterval only values from the above list can be provided as is. Optional; if fixedInterval is used then startTimeFullStr and endTimeFullStr should not be used.
4. startTimeFullStr=the start time full string, formatted according to the XpoLog system format; default format is MM/dd/yyyy HH:mm:ss
   endTimeFullStr=the end time full string, formatted according to the XpoLog system format; default format is MM/dd/yyyy HH:mm:ss
   Optional; used only if fixedInterval is missing; if used, both values are mandatory.
5. maxNumOfRecords=the maximal number of records to return in the result; if missing, the default value is taken from the widgets.searchAPI.maxNumOfRecords XpoLog system property (default is 100 but may be modified)
6. resultFormat=the format in which the result will be returned. Optional values xml/csv (case sensitive)
7. paginate=activate pagination; optional values true/false. If pagination is set to true, a unique token will be generated per execution (unless the API command will specify an existing token to access next pages of an existing execution as detailed below at 7.a).
   
   1. token=UNIQUE_TOKEN_FROM_FIRST_EXECUTION - returned and may be used only if pagination is set to true, and only after an API command execution which is not already using an existing unique token. 
      If token is added to the URL, each execution of the URL returns the next page of that execution result (see result example below of pagination = true).
      In order to access the next pages of that execution result, it is required to add to the URL the parameter:
      &token=UNIQUE_TOKEN_FROM_FIRST_EXECUTION - any additional execution using the unique token will return the next page of results (there is no paging backwards, only forward).
8. maxRecordsPerPage=the maximal number of results per page; If missing, the default value is 100 records per page.
9. timeout=the maximum time(milliseconds) given for a query to run. In case the time exceeds the given threshold, the search query stops and an error message is returned (see error codes table).
10. abortOn=the maximum number of allowed results.  In case the number exceeds the given threshold, the search query stops and an error message is returned (see error codes table).
    
    

The following is the XML structure of the API execution response (pagination = false):

<APIResult>
<Status state="OK" token="" numberOfResults="Actual number of results or maxNumOfRecords if exists/reached">
<Url>
[URL_TO_RESULT_FILE]
</Url>
<Message/>
</Status>
<Data>
</Data>
</APIResult>

The following is the XML structure of the API execution response (pagination = true):

<APIResult>
<Status state="OK" token="EXECUTION_TOKEN" numberOfResults="maxRecordsPerPage or maximum 100 per page (XpoLog default)">
<Url>
[URL_TO_RESULT_FILE]
</Url>
<Message/>
</Status>
<Data>
</Data>
</APIResult>

Examples

(You need to change machine/port/logs names, ids / folder names, ids / application names, ids if used to be relevant to your environment)

• Returns records matching the search query “error or fail* in logs that their names start with “log4j” in the specified time frame. Result is limited to maximum 1000 log records in csv format:

http://localhost:30303/logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=error or fail* in log.log4j*&startTimeFullStr=01/01/2014 00:00:00&endTimeFullStr=02/02/2014 00:00:00&maxNumOfRecords=1000&resultFormat=csv

- Returns records matching the search query “error or exception in in all logs in the last 7 days’ time frame. Result is limited to maximum 1000 log records in xml format:

http://localhost:30303/logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=error or exception&fixedInterval=last7Days&maxNumOfRecords=1000&resultFormat=xml

- Returns the complex search query '* in app.Windows Event Logs | count | group by event' result in the last 7 days’ time frame. Result is limited to maximum 1000 entries in csv format. In this example the URL also contains a username and password (admin/admin) that will perform a login to XpoLog in order to be able to execute the search query:

http://localhost:30303/logeye/view/api/widgetAPI.jsp?widgetId=searchAPI&searchQuery=*%20in%20app.Windows%20Event%20Logs%20|%20count%20|%20group%20by%20event&fixedInterval=last7Days&maxNumOfRecords=1000&resultFormat=csv&autoLogin=true&username=admin&password=admin

URL that returns a Dashboards latest result in PDF format

1. http://[MACHINE_NAME]:[XPOLOG_PORT]/logeye/view/api/dashboardAPI.jsp?action=export&appName=[see item 2]&viewName=[see item 3]
2. appName=a name of an existing App in XpoLog (case insensitive).
3. viewName=a name of an existing Dashboard in XpoLog (case insensitive).

Examples

(You need to change machine/port/logs names, ids / folder names, ids / application names, ids if used to be relevant to your environment)

- Returns the Dashboard “Dashboard-1” in PDF format

http://localhost:30303/logeye/view/api/dashboardAPI.jsp?action=export&appName=App-1&viewName=Dashboard-1

URL to open Search console on an executed search query

1. http://[MACHINE_NAME]:[XPOLOG_PORT]/logeye/search/view/loadSearchModel.jsp?searchQuery=[see item 2]&fixedInterval=[see item 3]&startTimeFullStr=[see item 4]&endTimeFullStr=[see item 4]
2. searchQuery=a query as used in XpoSearch console
3. fixedInterval=optional values are: last15Minutes, last30Minutes, last60Minutes, last3Hours, last12Hours, last24Hours, last7Days, last14Days, last1Months, last6Months, currentDay, previousDay, currentWeek, previousWeek, allData
   IMPORTANT: when using fixedInterval only values from the above list can be provided as is. Optional; if fixedInterval is used then startTimeFullStr and endTimeFullStr should not be used.
4. startTimeFullStr=the start time full string, formatted according to the XpoLog system format; default format is MM/dd/yyyy HH:mm:ss 
   endTimeFullStr=the end time full string, formatted according to the XpoLog system format; default format is MM/dd/yyyy HH:mm:ss
   Optional; used only if fixedInterval is missing; if used, both values are mandatory.

Examples

(You need to change machine/port/logs names, ids / folder names, ids / application names, ids if used to be relevant to your environment)

- Presents Search console after execution of the search query “error” in the specified time frame:

http://localhost:30303/logeye/search/view/loadSearchModel.jsp?searchQuery=error&startTimeFullStr=01/01/2014 00:00:00&endTimeFullStr=02/02/2014 00:00:00

- Presents Search console after execution of the search query “error” in the specified time frame (last 7 days):

http://localhost:30303/logeye/search/view/loadSearchModel.jsp?searchQuery=error&fixedInterval=last7Days

URL to open a specific log in the Log Viewer

1. http://[MACHINE_NAME]:[XPOLOG_PORT]/logeye/view/api/logViewAPI.jsp?logId=[see in item 2]&searchQuery=[see item 3]&logFilterName=[see item 4]&filterName=[see item 5]&filterId=[see item 6]&startTimeFullStr=[see item 7]&endTimeFullStr=[see item 8]&opdirect=[see item 9]&expandLogViewer=[see item 10]
2. logId=one or more log ids, separated by comma (mandatory parameter)
3. searchQuery=a term to filter the log by (similar syntax to XpoSearch)
4. logFilterName=the name to be given to the filter defined in item c; if missing, the name of the filter will be ‘external filter’
5. filterName=the name of an existing filter that should be activate on the log; used only if the searchQuery parameter is missing
6. filterId=the id of an existing filter that should be activate on the log; used only if the searchQuery parameter is missing or if the filterName parameter is missing or does not match an existing filter’s name
7. startTimeFullStr=the start time full string, formatted according to the XpoLog system format; default format is MM/dd/yyyy HH:mm:ss
8. endTimeFullStr=the end time full string, formatted according to the XpoLog system format; default format is MM/dd/yyyy HH:mm:ss
9. opdirect=start will display the first records of the result; last will display the last records. Default is start.
10. expandLogViewer=true will present the log in the viewer without the folder and logs and the menu presented. Default is false.

* Contact XpoLog Support to find out how to retrieve applications/folders/logs/filters IDs.

Examples

(You need to change machine/port/logs names, ids / folder names, ids / application names, ids if used to be relevant to your environment)

- Enter the viewer on the log Application_1235558747694 filtered on records that contain ‘error or information’ (the name of the temporary filter is set to be testQuery):

http://localhost:30303/logeye/view/api/logViewAPI.jsp?logId=Application_1235558747694&searchQuery=error or information&logFilterName=testQuery 

- Enter the viewer on the log Application_1235558747694 with an existing filter named ‘error’ activated (the last matching events will be presented):

http://localhost:30303/logeye/view/api/logViewAPI.jsp?logId=Application_1235558747694&filterName=error&opdirect=last

- Enter the viewer on a merge of the logs Application_1235558747694 and Security_1235558747851 filtered on records in the specified time frame (the name of the filter is set to be testTimeFilter):

http://localhost:30303/logeye/view/api/logViewAPI.jsp?logId=Application_1235558747694,Security_1235558747851&logFilterName=testTimeFilter&startTimeFullStr=01/01/2014 00:00:00&endTimeFullStr=02/01/2014 00:00:00

- Enter the viewer on the log Application_1235558747694 with the filter ‘error’ activated but also filtered on records in the specified time frame (the name of the temporary filter is set to be testFilterAndTime and the last matching events will be presented). Log viewer will be expanded (the folders and logs tree and the top menus will not be presented):

http://localhost:30303/logeye/view/api/logViewAPI.jsp?logId=Application_1235558747694&logFilterName=testFilterAndTime&filterName=error&opdirect=last&startTimeFullStr=05/01/2012 00:00:00&endTimeFullStr=05/03/2012 00:00:00&expandLogViewer=true

URL to enter XpoLog under specific Folder(s) context

1. http://[MACHINE_NAME]:[XPOLOG_PORT]/logeye/componentAction.jsp?selectedCompId=XpoLog&forward=root.jsp?folderId=[see item 2]&mainPage=view/mainView.jsp
2. folderId=a comma separated list of folder ids (mandatory parameter)

* Contact XpoLog Support to find out how to retrieve applications/folders/logs/filters IDs.

Examples

(You need to change machine/port/logs names, ids / folder names, ids / application names, ids if used to be relevant to your environment)

- Enter into XpoLog directly to view the folder with ID 1271697039748 under the Folders and Logs tree:

http://localhost:30303/logeye/componentAction.jsp?selectedCompId=XpoLog&forward=root.jsp?folderId=1271697039748&mainPage=view/mainView.jsp

- Enter into XpoLog directly to view the folders with IDs 1271697039748 and 1227520005721 under the Folders and Logs tree:

http://localhost:30303/logeye/componentAction.jsp?selectedCompId=XpoLog&forward=root.jsp?folderId=1271697039748,1227520005721&mainPage=view/mainView.jsp 

URL to enter XpoLog under specific AppTag(s) context

1. http://[MACHINE_NAME]:[XPOLOG_PORT]/logeye/componentAction.jsp?selectedCompId=XpoLog&forward=root.jsp?applicationId=[see item 2]&mainPage=view/mainView.jsp

2. applicationId=a comma separated list of AppTags ids (if an empty application id is provided, it will reset any AppTag context).

* Contact XpoLog Support to find out how to retrieve AppTags/Folders/Logs/filters IDs.

Examples

(You need to change machine/port/logs names, ids / folder names, ids / application names, ids if used to be relevant to your environment)

- Enter into XpoLog with under the AppTag app1 context:

http://localhost:30303/logeye/componentAction.jsp?selectedCompId=XpoLog&forward=root.jsp?applicationId=app1&mainPage=view/mainView.jsp 

- Enter into XpoLog with under the AppTags app1,app2 context:

http://localhost:30303/logeye/componentAction.jsp?selectedCompId=XpoLog&forward=root.jsp?applicationId=app1,app2&mainPage=view/mainView.jsp

Result: {"success":true,"errorMessage":null,"response":{"selected":false,"id":"Module-rootModule","name":"Folders and Logs","description":"","type":"Module","key":null,"hasChildrens":true,"children":[{"selected":false,"id":"Module-1227520005721","name":"Example Logs","description":"","type":"Module","key":null,"hasChildrens":true,"children":[{"selected":false,"id":"Log-Log4J_Log_1227520538204","name":"Log4J Log","description":"","type":"Log","key":null,"hasChildrens":false,"children":[]},{"selected":false,"id":"Log-IIS_Log_1227520737065","name":"IIS Log","description":"","type":"Log","key":null,"hasChildrens":false,"children":[]},{"selected":false,"id":"Log-Syslog_Log_1227521086597","name":"Syslog Log","description":"","type":"Log","key":null,"hasChildrens":false,"children":[]},{"selected":false,"id":"Module-1509627171374","name":"ssh","description":"","type":"Module","key":null,"hasChildrens":true,"children":[{"selected":false,"id":"Log-ssh_1509627248381","name":"ssh","description":"","type":"Log","key":null,"hasChildrens":false,"children":[]},{"selected":false,"id":"Module-1509611724539","name":"New Example Logs","description":"","type":"Module","key":null,"hasChildrens":true,"children":[{"selected":false,"id":"Log-xpologlog_1509628193290","name":"xpologlog","description":"","type":"Log","key":null,"hasChildrens":false,"children":[]}]}]}]}]},"httpStatusCode":0}

Result: {"success":true,"errorMessage":null,"response":{"type":"Log","id":"Log-IIS_Log_1227520737065","name":"IIS Log","description":"","path":null,"appTags":null,"collectionPolicy":"defaultLogCollectionPolicy","patterns":"{date:Date,locale=en,dd-MM-yyyy HH:mm:ss.SSS} {text:c-ip} {text:cs-username} {text:s-sitename} {text:s-computername} {ip:s-ip} {text:s-port} {text:cs-method} {text:cs-uristem} {text:cs-uri-query} {number:sc-status} {text:sc-win32-status} {text:sc-bytes} {text:time-taken} {text:cs-version} {text:cs-host} {text:cs(User-Agent)} {text:cs(Cookie)} {text:cs(Referer)}","filePaths":["IIS.log"],"accountName":null,"charSet":null,"timeZone":"Israel Standard Time","dataFilterQuery":null},"httpStatusCode":0}

type = the type of log
id = the id of the log in XpoLog
name = the name of the log in XpoLog
description = the description of the log in XpoLog
path = the Folders and Logs path of the log in XpoLog
appTags = the appTags that the log is tagged to (if applicable)
collectionPolicy = the name of the collection policy that the log is part of
patterns = the data patterns applied on the log
filesPath = the absolute path to the files that the log is defined on, separated by @#@# if there are multiple locations configured (if applicable)
accountName = the name of the account that the log is using (if applicable)
charSet = the char-set applied on the log
timeZone = the time zone applied on the log
dataFilterQuery = the data filter query applied on the log (if applicable)

type | id | name | description | path | appTags | collection policy | patterns | files paths | account name | char set | time zone | data Filter Query
Log | Log-Acute_Dispatch_1525684585842 | Acute Dispatch |  | ROOT->Logs Information->Acute Dispatch | LogsInformation | Default Collection Policy | {text:type} | {text:id} | {text:name} | {text:description} | {text:path} | {text:appTags} | {text:collection policy} | {text:patterns} | {text:files paths} | {text:account name} | {text:char set} | {text:time zone} | {text:data Filter Query} | C:\Users\omry.XPOLOG\Desktop\FMC\LexLogsInformation\Acute Dispatch.txt | null | null | Asia/Jerusalem | null

type = the type of returned object
id = the id of the log in XpoLog
name = the name of the log in XpoLog
description = the description of the log in XpoLog
path = the Folders and Logs path of the log in XpoLog
appTags = the appTags that the log is tagged to (if applicable)
collectionPolicy = the name of the collection policy that the log is part of
patterns = the data patterns applied on the log
filesPath = the absolute path to the files that the log is defined on, separated by @#@# if there are multiple locations configured (if applicable)
accountName = the name of the account that the log is using (if applicable)
charSet = the char-set applied on the log
timeZone = the time zone applied on the log
dataFilterQuery = the data filter query applied on the log (if applicable)

You can parse this data in XpoLog using the following pattern:

{text:type} | {text:id} | {text:name} | {text:description} | {text:path} | {text:appTags} | {text:collection policy} | {string:patterns} | {string:files paths} | {text:account name} | {text:char set} | {text:time zone} | {text:data Filter Query}