ON THIS PAGE
GET /config/event_sources/log_source_management/log_sources
SUMMARY Retrieves a list of log sources.
MIME Type |
---|
application/json |
Parameter | Type | Optionality | Data Type | MIME Type | Description |
---|---|---|---|---|---|
x-qrd-encryption-algorithm |
header |
Optional |
String |
text/plain |
The algorithm to use for encrypting the sensitive data of this endpoint. Must be one of: AES128 or AES256. |
x-qrd-encryption-password |
header |
Optional |
String |
text/plain |
The password to use for encrypting the sensitive data of this endpoint. |
Range |
header |
Optional |
String |
text/plain |
Optional - Use this parameter to restrict the number of elements that are returned in the list to a specified range. The list is indexed starting at zero. |
filter |
query |
Optional |
String |
text/plain |
Optional - This parameter is used to restrict the elements in a list base on the contents of various fields. |
sort |
query |
Optional |
String |
text/plain |
Optional - This parameter is used to sort the elements in a list. |
fields |
query |
Optional |
String |
text/plain |
Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas. |
HTTP Response Code | Unique Code | Description |
---|---|---|
200 |
The log sources were retrieved successfully. |
|
403 |
1010 |
Sensitive data requests require admin capabilities. |
422 |
1000 |
Sorting not supported on the provided field. |
422 |
1001 |
An invalid filter criteria was specified. |
422 |
1002 |
The 'x-qrd-encryption-algorithm' parameter does not match any of the available encryption algorithms. |
422 |
1003 |
The specified encryption strength is not available. Consider installing "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy" or using a weaker encryption. |
422 |
1004 |
The 'x-qrd-encryption-password' parameter is required. |
500 |
1020 |
An error occurred during the attempt to retrieve the log sources. |
Response Description
- id - Number - The ID of the log source.
- name - String - The unique name of the log source.
- description - String - An optional description of the log source.
- type_id - Number - The type of the log source. Must correspond to an existing log source type. See the Log Source Type API (/api/config/event_sources/log_source_management/log_source_types/).
- protocol_type_id - Number - The type of protocol that is used by the log source. Must correspond to an existing protocol type. See the Protocol Type API (/api/config/event_sources/log_source_management/protocol_types/). Individual log source types can support only a subset of all available protocol types, as indicated by the protocol_types field of the log source type structure.
- protocol_parameters - Array - The set of protocol parameters. This set is a collection of ProtocolParameter structures. The structure of the parameters is defined by the protocol type that is used by the log source. See the Protocol Type API (/api/config/event_sources/log_source_management/protocol_types/).
- enabled - Boolean - If the log source is enabled, the condition is set to 'true'; otherwise, the condition is set to 'false'.
- gateway - Boolean - If the log source is configured as a gateway, the condition is set to 'true'; otherwise, the condition is set to 'false'. A gateway log source is a stand-alone protocol configuration. The log source receives no events itself, and serves as a host for a protocol configuration that retrieves event data to feed other log sources. It acts as a "gateway" for events from multiple systems to enter the event pipeline.
- internal - Boolean - If the log source is internal (when the log source type is defined as internal), the condition is set to 'true'.
- credibility - Short - On a scale of 0 - 10 inclusive, the amount of credibility that the JSA administrator places on this log source.
- target_event_collector_id - Number - The ID of the event collector where the log source sends its data. The ID must correspond to an existing event collector. See the Event Collector API (/api/config/event_sources/event_collectors/).
- disconnected_log_collector_id - Number - The ID of the disconnected log collector where this log source will run. The ID must correspond to an existing disconnected log collector. See the Disconnected Log Collector API (/api/config/event_sources/disconnected_log_collectors/).
- coalesce_events - Boolean - If events collected by this log source are coalesced based on common properties, the condition is set to 'true'. If each individual event is stored, then the condition is set to 'false'.
- store_event_payload - Boolean - If the payloads of events that are collected by this log source are stored, the condition is set to 'true'. If only the normalized event records are stored, then the condition is set to 'false'.
- log_source_extension_id - Long - The log source extension associated with the log source. The ID must correspond to an existing log source extension or be set to 'null'. See the Log Source Extension API (/api/config/event_sources/log_source_management/log_source_extensions/)
- language_id - Integer - The language of the events that are being processed by this log source. Must correspond to an existing log source language. See the Log Source Language API (/api/config/event_sources/log_source_management/log_source_languages/). Individual log source types can support only a subset of all available log source languages, as indicated by the supported_language_ids field of the log source type structure
- group_ids - Array - The set of log source group IDs this log source is a member of. Each ID must correspond to an existing log source group. See the Log Source Group API (/api/config/event_sources/log_source_management/log_source_groups/).
- requires_deploy Boolean - Set to 'true' if you need to deploy changes to enable the log source for use; otherwise, set to 'false' if the log source is already active.
- status - Object - The status of the log source.
- auto_discovered - Boolean - If the log source was auto-discovered, the condition is set to 'true'. If the log source was created by a user, then the condition is set to 'false'.
- average_eps - Number - The average events per second (EPS) rate of the log source over the last 60 seconds.
- creation_date - Number - The creation date/time of the log source (in milliseconds since epoch).
- modified_date - Number - The last modified date/time of the log source (in milliseconds since epoch).
- last_event_time - Number - The date/time of the last event received by the log source (in milliseconds since epoch).
- wincollect_internal_destination_id - Long - The internal WinCollect destination for this log source, if applicable. Log sources without an associated WinCollect agent have a null value. Must correspond to an existing WinCollect destination. See the WinCollect Destination API (/api/config/event_sources/wincollect/wincollect_destinations/).
- wincollect_external_destination_ids - Array<Long> - The set of external WinCollect destinations for this log source, if applicable. Log Sources without an associated WinCollect agent have a null value. Each ID must correspond to an existing WinCollect destination. See the WinCollect Destination API (/api/config/event_sources/wincollect/wincollect_destinations/).
- legacy_bulk_group_name - Array<Long> - The name of the legacy bulk group that this log source belongs to. If the field is null, then the log source is not part of any legacy bulk groups.
- sending_ip - String - The ip of the system which the log source is associated to, or fed by.
- parsing_order - Integer - The order in which log sources will parse if multiple exists with a common identifier.
Response Sample
[{"sending_ip": "String", "internal": true, "legacy_bulk_group_name": "String", "protocol_parameters": [{"name": "String", "id": 42, "value": "String"}], "description": "String", "coalesce_events": true, "enabled": true, "parsing_order": 42, "group_ids": [42], "average_eps": 42, "credibility": 42, "id": 42, "store_event_payload": true, "target_event_collector_id": 42, "protocol_type_id": 42, "language_id": 42, "creation_date": 42, "log_source_extension_id": 42, "wincollect_external_destination_ids": [42], "name": "String", "auto_discovered": true, "modified_date": 42, "type_id": 42, "last_event_time": 42, "requires_deploy": true, "gateway": true, "wincollect_internal_destination_id": 42, "status": {"last_updated": 42, "messages": [{"severity": "String", "text": "String", "timestamp": 42}], "status": "String"}, "disconnected_log_collector_id": 42}]