Layerlog API

E-mail: destek@layerlog.com URL: https://api-docs.layerlog.com/ License: Apache 2.0 Terms of Service

Introduction

This API is documented using the OpenAPI 2.0 specification.

Account region and API URL

To find your account region, sign in to Layerlog and look at the URL in the address bar. Your API URL has the same two-letter code that you see in the address bar when you're logged in.

For more information, see Account region.

Authentication

The Layerlog API is available to Pro and Enterprise plan subscribers. You can generate and delete API tokens in your Layerlog account.

X-API-TOKEN

You can manage your API tokens from the Layerlog API tokens page.

API tokens are account-specific. You will need to be logged into the relevant Log Management or SIEM account to view the API tokens associated with it.

To manage your API tokens, log into the relevant account in your Layerlog platform, click the gear in the top-right menu, and select Tools > Manage tokens > API tokens.

It's important to keep your tokens secure. API tokens carry privileges to make changes to users and accounts, so if you believe an API token has been compromised, delete it, and replace it with a new token in your integrations.

Security Scheme Type	API Key
Header parameter name:	X-API-TOKEN

Rate limiting

API call and response rates are limited to 100 concurrent API requests per account. To verify your rate limits or request changes to your plan, please contact your account manager or the Customer Success Team.

Search logs

Use the Elasticsearch Search API DSL query language to search your Layerlog data.

To ensure system performance and data availability, we've introduced some limitations to the original Elasticsearch specification. These limitations are detailed in the applicable API calls below.

Search logs

post /v1/search

US East (Northern Virginia)

https://api.layerlog.com/v1/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/search

Canada (Central)

https://api-ca.layerlog.com/v1/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/search

Europe (London)

https://api-uk.layerlog.com/v1/search

West US 2 (Washington)

https://api-wa.layerlog.com/v1/search

Searches your account data using the Elasticsearch Search API DSL query language.

total: This call returns up to 1,000 results per query for aggregated results, or 10,000 results for non-aggregated results.

Note: To ensure speed and availability of your logs, we restrict some options from the Elasticsearch defaults that could hamper system performance. Restrictions are described with their respective elements below.

Authorizations:

X-API-TOKEN

query Parameters

dayOffset

integer >= 0

Slide the 2-day search time range by x days. For example, if set to 5, search returns results from 5 days ago and 4 days ago, UTC.

Maximum is your account's retention period.

If set to 0 or 1, search returns default results (today and yesterday, UTC).

accountIds

integer

ID of the sub account to search. By default, only this account is searched.

A main account can search a sub account as long as it has the right permissions. To give search permissions to the main account, log in to the main account, go to the Manage accounts page, and select Searchable from the main account for the intended sub account.

To include multiple accounts, repeat this parameter for each account (for example: accountIds=500&accountIds=600).

Important: If you include an account without the right permissions, the request will fail.

If you include this parameter, the current account won't be searched unless you explicitly include it in the query.

Request Body schema: application/json

query required	object The query can take any of the parameters described in the Elasticsearch Search API DSL documentation with the exceptions stated below. Limitations When using `query_string`, `allow_leading_wildcard` must be set to `false` `wildcard` can't start with `*` or `?` Can't contain `fuzzy_max_expansions`, `max_expansions`, or `max_determinized_states` Notes on the search time range By default, your query runs on data sent today and yesterday, UTC. You can move this 2-calendar-day window by using the `dayOffset` query parameter. Searches without a `timestamp` filter will return the last 2 calendar days, UTC. You can search other calendar days (up to 2 at a time) using a filter on the `timestamp`.
from	integer >= 0 Default: 0 Of the results found, the first result to return.
size	integer <= 10,000 Default: 10 Number of results to return
sort	Array of objects Limitations Can't sort or aggregate on analyzed fields, such as the `message` field
_source	object The object `includes` specifies an array of strings specifying an array of fields to return. If you omit `_source` from the request, all fields are returned. If you pass `'_source': false`, it will exclude the `_source` field from the results.
post_filter	object A filter applied after the aggregations have been calculated. Useful for reusing a single query to calculate several outputs with different filtering criteria. See the Elasticsearch guide for details.
docvalue_fields	Array of objects Powers inverted indexing. Allows queries to look up the search term in unique sorted list of terms, for faster access to the list of documents that contain the term. See the Elasticsearch guide for details.
version	boolean Returns a version for each result. See the Elasticsearch guide for details.
stored_fields	array of strings Useful for querying for fields that don’t appear in the _source field or querying for larger documents by date or title. See the Elasticsearch guide for details.
highlight	object Highlight strings in one or more fields in your search results. See the Elasticsearch guide for details.
aggregations	object Apply field aggregations. See the Elasticsearch guide for details. Limitations When using the `size` element, the value must be ≤ `1000` Can't nest 2 or more bucket aggregations of these types: `date_histogram`, `geohash_grid`, `histogram`, `ip_ranges`, `significant_terms`, `terms` Can't sort or aggregate on analyzed fields, such as the `message` field Aggregation type `significant_terms` and `multi_terms` can't be used Note: You can use `aggs` or `aggregations` as the field name

Responses

200

successful query. hits are the total number of logs that match the query, which will always be in the 0-2 day range. total are the actual logs that are returned when using the query, which are not limited by the selected time range.

Response Schema: application/json

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"query": 
{"bool": 
{"must": 
[
{"range": 
{"@timestamp": 
{"gte": "now-5m",
"lte": "now"
}
}
}
]
}
},
"from": 0,
"size": 0,
"sort": 
[{ }
],
"_source": false,
"post_filter": null,
"docvalue_fields": [ ],
"version": true,
"stored_fields": 
["*"
],
"highlight": { },
"aggregations": 
{"byType": 
{"terms": 
{"field": "type",
"size": 5
}
}
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all

"{\n  \"hits\": {\n    \"total\": 339604,\n    \"max_score\": 0.0,\n    \"hits\": [ ]\n  },\n  \"aggregations\": {\n    \"byType\": {\n      \"doc_count_error_upper_bound\": 0,\n      \"sum_other_doc_count\": 44879,\n      \"buckets\": [\n        {\n          \"key\": \"web-app\",\n          \"doc_count\": 163690\n        }, {\n          \"key\": \"core-service\",\n          \"doc_count\": 64893\n        }\n      ]\n    }\n  }\n}"

Scroll logs

post /v1/scroll

US East (Northern Virginia)

https://api.layerlog.com/v1/scroll

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/scroll

Canada (Central)

https://api-ca.layerlog.com/v1/scroll

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/scroll

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/scroll

Europe (London)

https://api-uk.layerlog.com/v1/scroll

West US 2 (Washington)

https://api-wa.layerlog.com/v1/scroll

This endpoint can take 2 types of call requests. The first type runs a search query that returns a scrollID and the first batch of paginated results. The second request type passes only the scroll_id (The variation in the field name is intentional) to fetch the next batches of paginated results. This endpoint always returns results as a stringified JSON.

How it works:

First, send a request to establish the scrollID. This initial request contains the query object and additional parameters, similar to the v1/search endpoint, with the exception that dayOffset and accountIds are not supported. The request will return the field scrollId and the number of hits, representing the number of matching results.

Next, send the scroll_id in the request body to retrieve the log results as a stringified JSON. Each call returns the next page, where each page can return a maximum of 1000 results. Every time you resend the same scroll_id in the request body, it returns the next page until it reaches the end of the results.

Every time you send the request with the same scroll_id, the next batch of results is returned. Keep sending the same scroll ID as many times as needed to retrieve all of the available results. The results are paginated, and every request returns the next page, one at a time.

When the call returns an empty array, you'll know you've reached the end of your results.

Note:

Send the field scroll_id in requests (snake_case).
Receive the field scrollID in your responses (camelCase).

Authorizations:

X-API-TOKEN

Request Body schema: application/json

query

object

Add a search query to receive the scrollID in the result.

The query can take any of the parameters described in the Elasticsearch Search API DSL documentation with the exceptions stated below.

You can only add the query parameters if you are not passing the scroll_id in the request.

Limitations

The query can only run on 2 consecutive indexes. By default, the query runs on data sent today and yesterday. You can also add a filter on timestamp to search a smaller time frame.
When using query_string, allow_leading_wildcard must be set to false to disable leading wildcards. In other words, the query can't start with * or ?
Can't use fuzzy_max_expansions, max_expansions, or max_determinized_states

size

integer <int32> <= 1,000

Default: 10

Number of results to return

from

integer <int32> >= 0

Of the results found, the first result to return.

sort

Array of objects

Limitations

Can't sort on analyzed fields, such as the message field

_source

object

The object includes specifies an array of strings specifying an array of fields to return.

If you omit _source from the request, all fields are returned.
If you pass '_source': false, it will exclude the _source field from the results.

post_filter

object

scroll

string

These time units are supported:

Unit	Description
`m`	minutes
`s`	seconds
`ms`	milliseconds
`micros`	microseconds
`nanos`	nanoseconds

Limitations

Time search must be ≤ 5 minutes. If no time is specified, default is 1m (1 minute).

aggregations

object

Apply field aggregations. See the Elasticsearch guide for details.

Limitations

When using the size element, the value must be ≤ 1000
Can't nest 2 or more bucket aggregations of these types: date_histogram, geohash_grid, histogram, ip_ranges, significant_terms, terms
Can't sort or aggregate on analyzed fields, such as the message field
Aggregation type significant_terms and multi_terms can't be used
If the request specifies aggregations, only the initial search response will contain the aggregations results

Note: You can use aggs or aggregations as the field name

Responses

200

successful operation. hits are the total number of logs that match the query, which will always be in the 0-2 day range. total are the actual logs that are returned when using the query, which are not limited by the selected time range.

Response Schema: application/json

code	integer <int32>
scrollId	string Keep passing this ID in the request until you've retrieved all of the results. Copy this ID and pass it as the field `scroll_id` in a request to the same endpoint to retrieve the next page of results. (Remember to first clear the request body of all other parameters.)
hits	string Query results in stringified JSON format. 'hits' are the total number of logs that match the query.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"query": { },
"size": 50,
"from": 0,
"sort": 
[{ }
],
"_source": 
{"includes": 
["message"
]
},
"post_filter": { },
"scroll": "string",
"aggregations": 
{"byType": 
{"terms": 
{"field": "type",
"size": 5
}
}
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"code": 200,
"scrollId": "DnF1ZXJ5VGhlbkZldGNoCQAAAAAWXRbqFlNpSWRrTUtXUUR1N1pJbG9uSkJINncAAAAAFp6B-xZTTVFrMGt4eVFnZXhQZV9YbVRrU3NnAAAAABakA8QWNjY1RUZtdWZRS1NZZWt1ZERTNHNaQQAAAAAWXRbrFlNpSWRrTUtXUUR1N1pJbG9uSkJINncAAAAAFl0W7BZTaUlka01LV1FEdTdaSWxvbkpCSDZ3AAAAABQ1nb4WVjRyRlUxZWRUU0dzbTV5VVVqYkhxdwAAAAAUdHVqFlF0b3Znei1ZUXgtZEkyZkR3M0pMbGcAAAAAFvGs6hZKVklxaXIyZ1NOQzF5NHg1cmhtVDV3AAAAABR0dWkWUXRvdmd6LVlReC1kSTJmRHczSkxsZw==",
"hits": "string"
}

Alerts

Layerlog alerts use a Kibana search query to continuously scan your logs and alert you when a certain set of conditions is met. The simplest alerts can use a simple search query or a particular filter, but others can be quite complex and involve several conditions with varying thresholds.

When alerts trigger, they write event logs. Event logs of triggered alerts are always available and searchable in Kibana - just filter for _exists_:logzio-alert. But you also have the option to add notifications, and control their contents, format, and who they are sent to.

For the deprecated alerting version, please see our public GitHub project.

Retrieve all alerts

get /v2/alerts

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts

Canada (Central)

https://api-ca.layerlog.com/v2/alerts

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts

Europe (London)

https://api-uk.layerlog.com/v2/alerts

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts

Returns the complete list of all alerts configured for the account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> Layerlog alert ID.
updatedAt	string Date and time in UTC when the alert was last updated.
updatedBy	string Email of the user who last updated the alert.
createdAt	string Date and time in UTC when the alert was first created.
createdBy	string Email of the user who first created the alert.
enabled	boolean If `true`, the alert is currently active.
title	string Alert title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubAlert) Determines when the alert should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.952Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.952Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}
]

Create an alert

post /v2/alerts

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts

Canada (Central)

https://api-ca.layerlog.com/v2/alerts

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts

Europe (London)

https://api-uk.layerlog.com/v2/alerts

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts

Configures and activates a new alert.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

title required	string Alert title
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings [ 0 .. 10 ] items Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC. The default value is 5.
subComponents required	Array of objects (SubAlert) Sets the search criteria using a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
enabled	boolean If `true`, the alert is enabled and active. Default value is `true`.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog alert ID.
updatedAt	string Date and time in UTC when the alert was last updated.
updatedBy	string Email of the user who last updated the alert.
createdAt	string Date and time in UTC when the alert was first created.
createdBy	string Email of the user who first created the alert.
enabled	boolean If `true`, the alert is currently active.
title	string Alert title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubAlert) Determines when the alert should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 20,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"enabled": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.952Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.952Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Retrieve alert by ID

get /v2/alerts/{alertId}

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts/{alertId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts/{alertId}

Canada (Central)

https://api-ca.layerlog.com/v2/alerts/{alertId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts/{alertId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts/{alertId}

Europe (London)

https://api-uk.layerlog.com/v2/alerts/{alertId}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts/{alertId}

Returns alert details by alert ID.

Authorizations:

X-API-TOKEN

path Parameters

alertId

required

integer <int32>

Example: 563412

Unique identifier of the alert in Layerlog.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog alert ID.
updatedAt	string Date and time in UTC when the alert was last updated.
updatedBy	string Email of the user who last updated the alert.
createdAt	string Date and time in UTC when the alert was first created.
createdBy	string Email of the user who first created the alert.
enabled	boolean If `true`, the alert is currently active.
title	string Alert title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubAlert) Determines when the alert should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.952Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.952Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Update an alert

put /v2/alerts/{alertId}

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts/{alertId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts/{alertId}

Canada (Central)

https://api-ca.layerlog.com/v2/alerts/{alertId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts/{alertId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts/{alertId}

Europe (London)

https://api-uk.layerlog.com/v2/alerts/{alertId}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts/{alertId}

Applies changes to an alert, identified by its ID. Can be used to enable or disable the alert.

Authorizations:

X-API-TOKEN

path Parameters

alertId

required

integer <int32>

Example: 563412

Unique identifier of the alert in Layerlog.

Request Body schema: application/json

title required	string Alert title
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings [ 0 .. 10 ] items Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC. The default value is 5.
subComponents required	Array of objects (SubAlert) Sets the search criteria using a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
enabled	boolean If `true`, the alert is enabled and active. Default value is `true`.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog alert ID.
updatedAt	string Date and time in UTC when the alert was last updated.
updatedBy	string Email of the user who last updated the alert.
createdAt	string Date and time in UTC when the alert was first created.
createdBy	string Email of the user who first created the alert.
enabled	boolean If `true`, the alert is currently active.
title	string Alert title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubAlert) Determines when the alert should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 20,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"enabled": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.952Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.952Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Delete an alert

delete /v2/alerts/{alertId}

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts/{alertId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts/{alertId}

Canada (Central)

https://api-ca.layerlog.com/v2/alerts/{alertId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts/{alertId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts/{alertId}

Europe (London)

https://api-uk.layerlog.com/v2/alerts/{alertId}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts/{alertId}

Deletes an alert identified by its ID.

Authorizations:

X-API-TOKEN

path Parameters

alertId

required

integer <int32>

Example: 563412

Unique identifier of the alert in Layerlog.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog alert ID.
updatedAt	string Date and time in UTC when the alert was last updated.
updatedBy	string Email of the user who last updated the alert.
createdAt	string Date and time in UTC when the alert was first created.
createdBy	string Email of the user who first created the alert.
enabled	boolean If `true`, the alert is currently active.
title	string Alert title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering alerts and triggered alerts. Can be used in Kibana Discover, dashboards, and more.
output	object (AlertOutput) Automatically sends out notifications with sample results when the alert triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the alert's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The alert runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubAlert) Determines when the alert should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubAlertCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the alert’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the alert to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.952Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.952Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"shouldUseAllFields": true
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Enable alert by ID

post /v2/alerts/{id}/enable

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts/{id}/enable

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts/{id}/enable

Canada (Central)

https://api-ca.layerlog.com/v2/alerts/{id}/enable

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts/{id}/enable

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts/{id}/enable

Europe (London)

https://api-uk.layerlog.com/v2/alerts/{id}/enable

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts/{id}/enable

Enables an alert by its alert ID. This is reversible. The alert can be disabled again at any time.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 654312

Alert ID

Responses

default

successful operation

Disable alert by ID

post /v2/alerts/{id}/disable

US East (Northern Virginia)

https://api.layerlog.com/v2/alerts/{id}/disable

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/alerts/{id}/disable

Canada (Central)

https://api-ca.layerlog.com/v2/alerts/{id}/disable

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/alerts/{id}/disable

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/alerts/{id}/disable

Europe (London)

https://api-uk.layerlog.com/v2/alerts/{id}/disable

West US 2 (Washington)

https://api-wa.layerlog.com/v2/alerts/{id}/disable

Disables an alert by its alert ID. This is reversible. The alert can be enabled again at any time.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 654321

Alert ID

Responses

default

successful operation

Retrieve triggered alerts

post /v1/alerts/triggered-alerts

US East (Northern Virginia)

https://api.layerlog.com/v1/alerts/triggered-alerts

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/alerts/triggered-alerts

Canada (Central)

https://api-ca.layerlog.com/v1/alerts/triggered-alerts

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/alerts/triggered-alerts

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/alerts/triggered-alerts

Europe (London)

https://api-uk.layerlog.com/v1/alerts/triggered-alerts

West US 2 (Washington)

https://api-wa.layerlog.com/v1/alerts/triggered-alerts

Returns a paged filtered list of triggered alerts for your accounts.

Authorizations:

X-API-TOKEN

query Parameters

from	integer >= 0 Default: 0 Of the results found, the first result to return.
size	integer Example: size=15 Size of page to return.
search	string Example: search=test Part of the alert name to filter by name (ignore case).
severities	Array of strings Items Value: ["SEVERE","HIGH","MEDIUM","LOW","INFO"] Example: severities=["SEVERE", "HIGH"] Filter results by severity of triggered alerts.
sortBy	string Enum: "DATE" "SEVERITY" Sort alerts by date or severity.
sortOrder	string Enum: "ASC" "DESC" Sort order of alerts retrieved.
tags	Array of strings List of tags the alert is related to.

Responses

200

successful operation

Response Schema: application/json

Array

pageSize	integer Size of page returned.
from	integer Of the results found, the first result to return.
total	integer Total number of alerts retrieved.
results	Array of objects Array of alerts retrieved by the search.

Request samples

cURL

Copy

curl -X POST https://api.layerlog.com/v1/alerts/triggered-alerts \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \
  -d '{
	"from": 0,
	"size": 15,
	"search": "test",
	"severities": ["HIGH", "LOW"],
	"sortBy": "DATE",
	"sortOrder": "ASC",
  "tags": "network"
}'

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"pageSize": 2,
"from": 1,
"total": 2,
"results": 
[
{"alertId": 1,
"name": "test",
"eventDate": 1523970558.657,
"severity": "HIGH"
}
]
}
]

Deployments

Send deployment logs by API to automatically correlate exceptions with service deployments directly in your Layerlog Exceptions tab.

Add deployment markers to Exception graphs

post /v2/markers/create-markers

US East (Northern Virginia)

https://api.layerlog.com/v2/markers/create-markers

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/markers/create-markers

Canada (Central)

https://api-ca.layerlog.com/v2/markers/create-markers

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/markers/create-markers

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/markers/create-markers

Europe (London)

https://api-uk.layerlog.com/v2/markers/create-markers

West US 2 (Washington)

https://api-wa.layerlog.com/v2/markers/create-markers

Send logs with details of service deployments to annotate Exception graphs in Kibana Discover. Learn more about Deployment markers

Authorizations:

X-API-TOKEN

Request Body schema: application/json

markers

Array of objects (MarkerDataPoint)

Responses

default

successful operation

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"markers": 
[
{"title": "ServiceA",
"tag": "OTHER",
"example": null,
"enum": null,
"timestamp": 1613311091679,
"description": "Description with additional context",
"metadata": 
{"version": "version 5",
"deployer": "iron man"
}
}
]
}

Insights

Layerlog monitors your logs for Insights to help you preempt issues and alert you of potential problems.

There are two types of Insights:

LOGCEPTION - Application errors and exceptions identified in the stack trace.
PUBLIC_CI - Cognitive Insights correlate your logs with vulnerabilities and issues that are trending in the open source community.

You have the option to set up an alert so you can get notified of the details when new or recurring insights are spotted in your system.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Get the list of Insights

post /v1/insights/list

US East (Northern Virginia)

https://api.layerlog.com/v1/insights/list

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/insights/list

Canada (Central)

https://api-ca.layerlog.com/v1/insights/list

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/insights/list

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/insights/list

Europe (London)

https://api-uk.layerlog.com/v1/insights/list

West US 2 (Washington)

https://api-wa.layerlog.com/v1/insights/list

Get the list of Insights that match your search criteria.

Whenever a new Insight is detected, it receives an Insight ID and is tracked for as long as it recurs. The lookback period for Insights is 6 months.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

startDate	integer <int64> UNIX timestamp in milliseconds specifying the start date for the query time frame. By default, returns the past 15 minutes ("now - 15 minutes" translated into a UNIX timestamp).
endDate	integer <int64> UNIX timestamp in milliseconds specifying the end date for the query time frame. By default, returns the current time ("now" translated into a UNIX timestamp).
from	integer <int32> Default: 0 Of the results found, the first result to return. Must be a non-negative integer.
size	integer <int32> [ 1 .. 100 ] Default: 10 Number of results to return. Must be a positive integer between 1-100.
insightTypes	Array of strings Default: ["PUBLIC_CI","LOGCEPTION"] Items Enum: "PUBLIC_CI" "LOGCEPTION" Filters results by Insight type. `LOGCEPTION` filters for application insights. `PUBLIC_CI` filters for Cognitive Insights.
tagNames	Array of strings Filters results by the tag values used to categorize Insights.
logTypes	Array of strings Filters results by log type.
onlyNew	boolean Default: false Filters for Insights that first occurred in the selected time frame. In other words, excludes Insights that were first identified before or after the selected time range.
sortBy	string Default: "COUNT" Enum: "FIRST_OCCURRENCE" "LAST_OCCURRENCE" "COUNT" Sorts Insights by the selected parameters.
asc	boolean Default: false If `false`, sorts Insights in descending order. The order depends on the selected `sortBy` paramater.
search	string Searches for an Insight by its title.

Responses

200

successful operation

Response Schema: application/json

pageSize	integer <int32> [ 0 .. 500 ] Number of results to return per page. Must be a positive integer between 0-500.
from	integer <int32> [ 0 .. 2147483647 ] UNIX timestamp in milliseconds.
total	integer <int64> [ 0 .. 500 ] Total number of results found.
results	Array of objects (PublicAccountInsightResponse)

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"startDate": 1592904389950,
"endDate": 1592254800000,
"from": 0,
"size": 100,
"insightTypes": 
["PUBLIC_CI",
"LOGCEPTION"
],
"tagNames": null,
"logTypes": 
["log-engine",
"spark"
],
"onlyNew": true,
"sortBy": "COUNT",
"asc": true,
"search": "Exception"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"pageSize": 0,
"from": 0,
"total": 0,
"results": 
[
{"insightId": "cf484f4c381c3e408a23accc5b487947d2f68791",
"insightType": "PUBLIC_CI",
"tagName": "ignite",
"description": "A match for the phrase - <'Could not find the language line'> was identified in the log message. As mentioned in the cited links, this may indicate that an issue has taken place that requires your attention.",
"links": "https://github.com/benedmunds/CodeIgniter-Ion-Auth/issues/784 https://www.sitepoint.com/multi-language-support-in-codeigniter/ http://forum.codeigniter.com/thread-383.html https://community.invoiceplane.com/t/topic/3322 https://www.zonwhois.com/www/gwdcanada.com.html",
"additionalData": 
{"property1": { },
"property2": { }
},
"firstOccurrence": 1591181276000,
"lastOccurrence": 1591253121194,
"count": 66,
"logTypes": 
["app-server",
"user-analytics"
],
"kibanaLink": "string",
"insightTitle": "Could not find the language line create_user_validation_phone_label"
}
]
}

Layerlog snapshots

Create a snapshot

post /v1/snapshotter

US East (Northern Virginia)

https://api.layerlog.com/v1/snapshotter

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/snapshotter

Canada (Central)

https://api-ca.layerlog.com/v1/snapshotter

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/snapshotter

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/snapshotter

Europe (London)

https://api-uk.layerlog.com/v1/snapshotter

West US 2 (Washington)

https://api-wa.layerlog.com/v1/snapshotter

Creates a new Kibana snapshot and shares with recipients through email or notification endpoint

Authorizations:

X-API-TOKEN

Request Body schema: application/json

snapshotType required	string Enum: "DASHBOARD" "VISUALIZATION" The object type to share
snapshotSavedObjectId required	string ID of the object to share. If you don't know the object ID, you can use the /kibana/export endpoint.
slackWebhookUrls	Array of strings URLs of Slack webhooks that you want to send this snapshot to. At least one of `emails`, `slackWebhookUrls`, and `endpoints` is required with each request. If all three are missing, the request will fail.
endpoints	Array of integers <int32> IDs of notification endpoints that you want to send this snapshot to At least one of `emails`, `slackWebhookUrls`, and `endpoints` is required with each request. If all three are missing, the request will fail.
emails	Array of strings Email addresses that you want to send this snapshot to At least one of `emails`, `slackWebhookUrls`, and `endpoints` is required with each request. If all three are missing, the request will fail.
message	string Message to send to the shared object recipients
timeFrameFrom required	integer <int64> Starting timedate of the visualization, as a Unix epoch integer.
timeFrameTo required	integer <int64> Ending timedate of the visualization, as a Unix epoch integer.
snapshotTimeZone required	string Time zone to use in `timeFrameFrom` and `timeFrameTo`
queryString	string Search query
darkTheme	boolean To send the object with Kibana dark theme colors, `true`. Otherwise, `false`.

Responses

200

successful operation

Response Schema: application/json

snapshotId

integer <int32>

ID of the snapshot

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"snapshotType": "DASHBOARD",
"snapshotSavedObjectId": "11f6a669-4f21-6313-dd83-319dbfc8ff96",
"slackWebhookUrls": 
["https://hooks.slack.com/services/CC29C43F8/7E6E833FB/Ebe297580E7FaC354F9D4d7"
],
"endpoints": 
[0
],
"emails": 
["string"
],
"message": "Take a look at these Apache logs, let me know if you want me to do anything about it",
"timeFrameFrom": 389836800,
"timeFrameTo": 414720000,
"snapshotTimeZone": "UTC",
"queryString": "type:example",
"darkTheme": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"snapshotId": 2049
}

Retrieve a snapshot by ID

get /v1/snapshotter/{snapshotId}

US East (Northern Virginia)

https://api.layerlog.com/v1/snapshotter/{snapshotId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/snapshotter/{snapshotId}

Canada (Central)

https://api-ca.layerlog.com/v1/snapshotter/{snapshotId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/snapshotter/{snapshotId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/snapshotter/{snapshotId}

Europe (London)

https://api-uk.layerlog.com/v1/snapshotter/{snapshotId}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/snapshotter/{snapshotId}

Returns the details of a snapshot, such as status and the snapshot image URL

Authorizations:

X-API-TOKEN

path Parameters

snapshotId

required

integer <int32>

Example: 3094

ID of the snapshot

Responses

200

successful operation

Response Schema: application/json

snapshotId	integer <int32> ID of the snapshot
accountId	integer <int32> ID of the account
snapshotType	string Enum: "DASHBOARD" "VISUALIZATION" The object type
status	string Enum: "SUCCESS" "FAILED" "IN_PROGRESS" Status of the snapshot capture operation
snapshotSavedObjectName	string Name of the object captured in the snapshot
imageUrl	string Web address where the snapshot image is stored
appLinkUrl	string A link to the snapshot in the Layerlog app
message	string Message to send to snapshot recipients
timeFrameFrom	integer <int64> Starting timedate of the visualization, as a Unix epoch integer.
timeFrameTo	integer <int64> Ending timedate of the visualization, as a Unix epoch integer.
snapshotTimeZone	string Time zone to use in `timeFrameFrom` and `timeFrameTo`

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/snapshotter/3094" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"snapshotId": 3094,
"accountId": 5555,
"snapshotType": "VISUALIZATION",
"status": "SUCCESS",
"snapshotSavedObjectName": "Mysql response times percentiles",
"imageUrl": "https://snapshotter-logzio-prod.s3.amazonaws.com/1234/567890/snapshots/8843_3094_dC6pBjbrWc1lfN7Gob82oJuSUxTGbm8D6hDE1TcR1pVzIVO0TsB3tuZEZs1YpOGh.png",
"appLinkUrl": "http://panel.layerlog.com/#/dashboard/kibana?kibanaRoute=%2Fvisualize%2Fedit%a4d365e001-5bc9-4851-1933-a70b45a67e9d%3F_g%3D%2528time%253A%2528from%253A%25272018-06-02T15",
"message": "Hey, let me know if you need me to do anything about this.",
"timeFrameFrom": 389836800,
"timeFrameTo": 414720000,
"snapshotTimeZone": "UTC"
}

Security account

A security account with SIEM allows you to use the SIEM platform. You can create a SIEM account using an API call.

Create SIEM account

post /v2/account-management/siem

US East (Northern Virginia)

https://api.layerlog.com/v2/account-management/siem

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/account-management/siem

Canada (Central)

https://api-ca.layerlog.com/v2/account-management/siem

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/account-management/siem

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/account-management/siem

Europe (London)

https://api-uk.layerlog.com/v2/account-management/siem

West US 2 (Washington)

https://api-wa.layerlog.com/v2/account-management/siem

Creates a new SIEM account. Returns SIEM account configuration settings as a JSON object. Must be run with an API token from the your main Logs account Logs > Settings > Manage tokens > API tokens.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

accountName required	string SIEM account name
accountsToScan	Array of integers IDs of accounts that will be accessed for logs. The owner account will be the default account to scan.
email required	string Email address of the SIEM account.
isUsingRepositoryAccount	boolean Describes if the account uses a Repository Account. For more information, see our User Guide.

Responses

200

successful query

Response Schema: application/json

accountId	integer Account ID.
accountName	string SIEM account name
accountsToScan	Array of integers Accounts included into the query
createdAt	string <date-time> Date this account was created. Format: `{yyyy}-{mm}-{dd}T{hh}:{mm}:{ss}Z`
isUsingRepositoryAccount	boolean Describes if the account uses a Repository Account. For more information, see our User Guide.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"accountName": "string",
"accountsToScan": 
[0
],
"email": "string",
"isUsingRepositoryAccount": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"accountId": 0,
"accountName": "string",
"accountsToScan": 
[0
],
"createdAt": "2025-12-07T12:21:52.950Z",
"isUsingRepositoryAccount": true
}

Security rules

Security rules help you connect the dots between your data sources and events that could indicate a security threat or breach.

Your Cloud SIEM account comes pre-configured with security rules for different attack types and security use cases. These built-in rules are protected, and there are limitations on the changes that can be made to them. Pre-configured rules can be updated by adding notification endpoints (like email or Slack), changing trigger thresholds and severities, and adding tags, as described in detail in the endpoint.

You can also create new security rules to supplement the built-in rules.

Create a security rule

post /v2/security/rules

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules

Europe (London)

https://api-uk.layerlog.com/v2/security/rules

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules

Creates a new security rule and activates it.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

title	string Rule title
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings [ 0 .. 25 ] items Tags for filtering rules and triggered rules. Can be used in Kibana Discover, dashboards, and more.
output	object (RuleOutput) Automatically sends out notifications with sample results when the rule triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the rule's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The rule runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents required	Array of objects (SubRule) Sets the search criteria using a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubRuleCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the rule’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the rule to trigger.
enabled	boolean If `true`, the alert is enabled and active.

Responses

201

successful operation

Response Schema: application/json

id	integer <int32> Layerlog rule ID.
updatedAt	string Date and time in UTC when the rule was last updated.
updatedBy	string Email of the user who last updated the rule.
createdAt	string Date and time in UTC when the rule was first created.
createdBy	string Email of the user who first created the rule.
enabled	boolean If `true`, the rule is currently active.
title	string Rule title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering rules and triggered rules. Can be used in Kibana Discover, dashboards, and more.
output	object (RuleOutput) Automatically sends out notifications with sample results when the rule triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the rule's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The rule runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubRule) Determines when the rule should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubRuleCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the rule’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the rule to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": "network",
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 20,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"enabled": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.953Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.953Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Retrieve a security rule

get /v2/security/rules/{ruleId}

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/{ruleId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/{ruleId}

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/{ruleId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/{ruleId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/{ruleId}

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/{ruleId}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/{ruleId}

Retrieves a security rule by its ID.

Authorizations:

X-API-TOKEN

path Parameters

ruleId

required

integer <int32>

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog security rule ID.
updatedAt	string Date and time in UTC when the rule was last updated.
updatedBy	string Email of the user who last updated the rule.
createdAt	string Date and time in UTC when the rule was first created updated.
createdBy	string Email of the user who first created the rule.
enabled	boolean If `true`, the rule is currently active.
title	string Rule title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering rules and triggered rules. Can be used in Kibana Discover, dashboards, and more.
output	object (RuleOutput) Automatically sends out notifications with sample results when the rule triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the rule's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The rule runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubRule) Determines when the rule should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubRuleCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the rule’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the rule to trigger.
protected	boolean If `true`, the rule is pre-defined by Layerlog. Protected parameters cannot be edited. The only parameters that can be edited are `shouldQueryOnAllAccounts` `accountIdsToQueryOn` `severityThresholdTiers` `tags` `description` `enabled` `output` (in `subComponents`) `searchTimeFrameMinutes`
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.
mitreTags	Array of strings Tags used for classifying, discussing, and interpreting security incidents. This feature is currently under development.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.954Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.954Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"protected": true,
"schedule": 
{"cron": "string",
"timezone": "string"
},
"mitreTags": 
["string"
]
}

Update a security rule

put /v2/security/rules/{ruleId}

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/{ruleId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/{ruleId}

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/{ruleId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/{ruleId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/{ruleId}

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/{ruleId}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/{ruleId}

Applies changes to a rule, identified by its ID. Can also be used to enable or disable a rule.

Authorizations:

X-API-TOKEN

path Parameters

ruleId

required

integer <int32>

Request Body schema: application/json

title	string Rule title
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings [ 0 .. 25 ] items Tags for filtering rules and triggered rules. Can be used in Kibana Discover, dashboards, and more.
output	object (RuleOutput) Automatically sends out notifications with sample results when the rule triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the rule's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The rule runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents required	Array of objects (SubRule) Sets the search criteria using a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubRuleCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the rule’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the rule to trigger.
enabled	boolean If `true`, the alert is enabled and active.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog rule ID.
updatedAt	string Date and time in UTC when the rule was last updated.
updatedBy	string Email of the user who last updated the rule.
createdAt	string Date and time in UTC when the rule was first created.
createdBy	string Email of the user who first created the rule.
enabled	boolean If `true`, the rule is currently active.
title	string Rule title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering rules and triggered rules. Can be used in Kibana Discover, dashboards, and more.
output	object (RuleOutput) Automatically sends out notifications with sample results when the rule triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the rule's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The rule runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubRule) Determines when the rule should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubRuleCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the rule’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the rule to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": "network",
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 20,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"enabled": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.953Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.953Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Delete a security rule

delete /v2/security/rules/{ruleId}

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/{ruleId}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/{ruleId}

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/{ruleId}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/{ruleId}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/{ruleId}

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/{ruleId}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/{ruleId}

Deletes a security rule by its ID.

Authorizations:

X-API-TOKEN

path Parameters

ruleId

required

integer <int32>

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog rule ID.
updatedAt	string Date and time in UTC when the rule was last updated.
updatedBy	string Email of the user who last updated the rule.
createdAt	string Date and time in UTC when the rule was first created.
createdBy	string Email of the user who first created the rule.
enabled	boolean If `true`, the rule is currently active.
title	string Rule title.
description	string A description of the event, its significance, and suggested next steps or instructions for the team.
tags	Array of strings Tags for filtering rules and triggered rules. Can be used in Kibana Discover, dashboards, and more.
output	object (RuleOutput) Automatically sends out notifications with sample results when the rule triggers.
searchTimeFrameMinutes	integer <int32> [ 5 .. 1440 ] The time frame for evaluating the log data is a sliding window, with 1 minute granularity. The recommended minimum and maximum values are not validated, but needed to guarantee the rule's accuracy. The minimum recommended time frame is 5 minutes, as anything shorter will be less reliable and unnecessarily resource-heavy. The maximum recommended time frame is 1440 minutes (24 hours). The rule runs on the index from today and yesterday (in UTC) and the maximum time frame increases throughout the day, reaching 48 hours exactly before midnight UTC.
subComponents	Array of objects (SubRule) Determines when the rule should trigger using any combination of a search query, filters, group by aggregations, accounts to search, and trigger conditions.
correlations	object (SubRuleCorrelation) Only applicable when multiple sub-components are in use. Selects a logic for correlating the rule’s sub-components. `AND` is currently the only supported operator. When `AND` is the `correlationOperator`, both sub-components must meet their triggering criteria for the rule to trigger.
schedule	object Defines the intervals in which an alert will be evaluated. This feature is still in production, but the payload already contains the data.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.953Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.953Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"schedule": 
{"cron": "string",
"timezone": "string"
}
}

Retrieve security rules

post /v2/security/rules/search

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/search

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/search

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/search

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/search

Retrieve a list of security rules for a specific Security account. The results are paginated. Filtering, sorting and pagination are all optional. If you want to get all rules, send the payload in {} format.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

filter	object (AlertsFilter)
sort	object (AlertsSortRequest)
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Responses

200

successful operation

Response Schema: application/json

total	integer <int32> The total number of rules returned by the query. The total entities found after filtering and sorting. This number is fixed and not affected by pagination.
results	Array of objects (SecurityRuleResponse)
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"filter": 
{"search": "string",
"severities": 
["SEVERE",
"HIGH"
],
"updatedBy": 
["string"
],
"createdBy": 
["string"
],
"enabledState": 
[true
],
"emailNotifications": 
["string"
],
"tags": 
["string"
]
},
"sort": 
{"sortByField": "SEVERITY",
"descending": true
},
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"total": 500,
"results": 
[
{"id": 627816,
"updatedAt": "2025-12-07T12:21:52.954Z",
"updatedBy": "tomer@layerlog.com",
"createdAt": "2025-12-07T12:21:52.954Z",
"createdBy": "tomer@layerlog.com",
"enabled": true,
"title": "Excessive WARN levels in PROD",
"description": "Steps to remediate...",
"tags": 
["network",
"aws"
],
"output": 
{"recipients": 
{"emails": 
["tom.a@layerlog.com"
],
"notificationEndpointIds": 
[0
]
},
"suppressNotificationsMinutes": 60,
"type": "JSON"
},
"searchTimeFrameMinutes": 5,
"subComponents": 
[
{"queryDefinition": 
{"query": "type:apache_access",
"filters": 
{"bool": 
{"must": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
],
"must_not": 
[
{"match_phrase": 
{"Field": 
{"query": "value"
}
}
}
]
}
},
"groupBy": 
["string"
],
"aggregation": 
{"aggregationType": "SUM",
"fieldToAggregateOn": "string"
},
"shouldQueryOnAllAccounts": false,
"accountIdsToQueryOn": 
[2321
]
},
"trigger": 
{"operator": "GREATER_THAN_OR_EQUALS",
"severityThresholdTiers": 
{"MEDIUM": 10,
"HIGH": 100,
"SEVERE": 300
}
},
"output": 
{"columns": 
[
{"fieldName": "string",
"regex": "string",
"sort": "DESC"
}
]
}
}
],
"correlations": 
{"correlationOperators": 
["AND"
],
"joins": 
[
{"0": "region",
"1": "region"
}
]
},
"protected": true,
"schedule": 
{"cron": "string",
"timezone": "string"
},
"mitreTags": 
["string"
]
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Enable a rule

post /v2/security/rules/{id}/enable

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/{id}/enable

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/{id}/enable

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/{id}/enable

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/{id}/enable

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/{id}/enable

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/{id}/enable

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/{id}/enable

Enables a security rule by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 305572

Rule ID

Responses

default

successful operation

Disable a rule

post /v2/security/rules/{id}/disable

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/{id}/disable

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/{id}/disable

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/{id}/disable

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/{id}/disable

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/{id}/disable

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/{id}/disable

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/{id}/disable

Disables a security rule by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 305976

Rule ID

Responses

default

successful operation

Security events

A security event is logged whenever a security rule triggers in your Layerlog Cloud SIEM account.

Your Layerlog Cloud SIEM is pre-loaded with hundreds of security rules created and maintained by Layerlog's security analysts. The list continues to be expanded and updated on a regular basis. You can also add your own security rules.

To investigate into security events, you can begin by running a bulk query to fetch security event logs, either with or without applying filtering criteria. This query returns all of the events that match the query parameters and can potentially fetch events going back many months. Whenever you encounter a particular event you would like to further investigate, you can run the drilldown query to fetch the logs that triggered the security event to delve deeper into the event details.

These queries can be used to integrate with an automated response solution such as Cortex xSOAR or simply to understand your security posture and identify suspicious activity in your accounts.

Fetch security events

post /v2/security/rules/events/search

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/events/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/events/search

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/events/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/events/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/events/search

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/events/search

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/events/search

Runs a search query in your Layerlog Cloud SIEM account to fetch the security events that match the query parameters.

You have the option to filter by rule name, rule severity, and/or event timestamp, and sort the results by time and/or severity, but this is not required. If you send the query with an empty JSON body, it returns all of the events logged in your Layerlog Cloud SIEM, going as far back as your account's retention permits.

Note: Run this endpoint with an API token for your Layerlog Security account.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

filter	object (RulesEventsFilter) Filter by rule name, rule severity, or time range.
sort	Array of objects (RulesEventsSortRequest) Explicit sorting rules are not required, but recommended. Otherwise the database will determine the sorting.
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Responses

200

successful operation

Response Schema: application/json

total	integer <int32> The total number of events returned by the query. The total entities found after filtering and sorting. This number is fixed and not affected by pagination.
results	Array of objects (TriggeredAlert)
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"filter": 
{"searchTerm": "Falco",
"severities": 
["SEVERE"
],
"timeRange": 
{"fromDate": 1587134557,
"toDate": 1587137557
},
"includeMutedEvents": true
},
"sort": 
[
{"field": "DATE",
"descending": true
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"total": 500,
"results": 
[
{"alertId": 453345,
"name": "AWS EC2 - Brute force SSH login attempts",
"description": "Suggested next steps...",
"alertSummary": "Alert if query '*' results GREATER_THAN_OR_EQUALS 5.00 in 10 minutes. Count on Group By '[userIdentity.userName, sourceIPAddress]'",
"eventDate": 1587860455,
"alertWindowStartDate": 1587856855,
"alertWindowEndDate": 1587860455,
"severity": "SEVERE",
"alertEventId": "27cdcf45-ae12-581a-809e-17a6bbc9ae07",
"groupBy": 
{"source_ip": "122.17.45.15",
"hostname": "hostname1234"
},
"tags": "threat",
"hits": 30,
"isMuted": true
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Fetch the logs that triggered a security event

post /v2/security/rules/events/logs/search

US East (Northern Virginia)

https://api.layerlog.com/v2/security/rules/events/logs/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/security/rules/events/logs/search

Canada (Central)

https://api-ca.layerlog.com/v2/security/rules/events/logs/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/security/rules/events/logs/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/security/rules/events/logs/search

Europe (London)

https://api-uk.layerlog.com/v2/security/rules/events/logs/search

West US 2 (Washington)

https://api-wa.layerlog.com/v2/security/rules/events/logs/search

Runs a search query in your Layerlog Log Monitoring account to fetch the logs that triggered the security rule and caused it to log a security event.

This query returns an array of parsed logs linked to a single event - it isn't a bulk action. Run this query to investigate an event and increase observability into details omitted from the security event log.

Note: Run this endpoint with an API token for your Layerlog Security account.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

filter required	object (RuleEventLogsFilter) Filter by the event's unique GUID to retrieve only the logs relevant to the event under investigation.
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Responses

200

successful operation

Response Schema: application/json

total	integer <int32> Returns the total number of logs linked to the security event specified in the query. This number is fixed and not affected by pagination.
results	Array of objects Array of logs returned in answer to the query. The logs are returned in their entirety and parsed. If the logs are no longer retained in the database, the request will return empty. You can check your account's log retention policy in your log monitoring account.
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"filter": 
{"alertEventId": "833203f9-de71-5a12-9083-9055a6d925bb"
},
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"total": 5,
"results": 
[
{"Array of logs": null
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Lookup lists

Create lookup list

post /v1/lookup-lists

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists

Creates a new lookup list. After you create the list, you can run the endpoint to add elements to the list.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

name	string [ 0 .. 40 ] characters Default: "Untitled##" Name of the lookup list. If null, the list will be named `Untitled` followed by the running number.
description	string [ 0 .. 400 ] characters A place to add a free text description of the lookup list's purpose, uses and dependencies.

Responses

200

successful operation

Response Schema: application/json

id	string GUID of the lookup list.
name	string [ 1 .. 40 ] characters Name of the lookup list.
description	string [ 0 .. 400 ] characters Description of the lookup list.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"name": "Untitled##",
"description": "string"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "7c985e09-3db6-5dc6-ae33-58403493e13f",
"name": "string",
"description": "string"
}

Get all/Search lookup lists

post /v1/lookup-lists/search

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/search

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/search

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/search

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/search

Searches for lookup lists by name or ID. Can also be run without a filter to return the full list of existing lookups. Returns a paginated list of results.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

filter	object (LookupListsFilter) Filter by names that contain a term, by lookup ID, or by both. If both properties are sent, they must both be satsified (`AND` logic).
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Responses

200

successful operation

Response Schema: application/json

total	integer <int32> Total number of search results.
results	Array of objects (LookupList)
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"filter": 
{"searchTerm": "servers",
"byIds": 
["string"
]
},
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"total": 0,
"results": 
[
{"id": "7c985e09-3db6-5dc6-ae33-58403493e13f",
"name": "string",
"description": "string"
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Get lookup by ID

get /v1/lookup-lists/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{id}

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{id}

Retrieves the general details for an existing lookup list.

Authorizations:

X-API-TOKEN

path Parameters

required

string

Example: 7c985e09-3db6-5dc6-ae33-58403493e13f

GUID of the lookup list.

Responses

200

successful operation

Response Schema: application/json

id	string GUID of the lookup list.
name	string [ 1 .. 40 ] characters Name of the lookup list.
description	string [ 0 .. 400 ] characters Description of the lookup list.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "7c985e09-3db6-5dc6-ae33-58403493e13f",
"name": "string",
"description": "string"
}

Update lookup list

put /v1/lookup-lists/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{id}

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{id}

Update the name and/or description of an exisiting lookup list.

Authorizations:

X-API-TOKEN

path Parameters

required

string

Example: 7c985e09-3db6-5dc6-ae33-58403493e13f

GUID of the lookup list.

Request Body schema: application/json

id	string GUID of the lookup list.
name	string [ 1 .. 40 ] characters Name of the lookup list.
description	string [ 0 .. 400 ] characters Description of the lookup list.

Responses

200

successful operation

Response Schema: application/json

id	string GUID of the lookup list.
name	string [ 1 .. 40 ] characters Name of the lookup list.
description	string [ 0 .. 400 ] characters Description of the lookup list.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"id": "7c985e09-3db6-5dc6-ae33-58403493e13f",
"name": "string",
"description": "string"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "7c985e09-3db6-5dc6-ae33-58403493e13f",
"name": "string",
"description": "string"
}

Delete lookup list

delete /v1/lookup-lists/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{id}

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{id}

Deletes a lookup list. Note that this action can affect rules, dashboards, and reports if they are dependent on the lookup list.

Authorizations:

X-API-TOKEN

path Parameters

required

string

Example: 7c985e09-3db6-5dc6-ae33-58403493e13f

GUID of the lookup list.

Responses

200

successful operation

Response Schema: application/json

id	string GUID of the lookup list.
name	string [ 1 .. 40 ] characters Name of the lookup list.
description	string [ 0 .. 400 ] characters Description of the lookup list.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "7c985e09-3db6-5dc6-ae33-58403493e13f",
"name": "string",
"description": "string"
}

Add element to a lookup list

post /v1/lookup-lists/{lookupListId}/elements

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{lookupListId}/elements

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{lookupListId}/elements

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{lookupListId}/elements

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{lookupListId}/elements

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{lookupListId}/elements

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{lookupListId}/elements

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{lookupListId}/elements

Adds a new element to an existing lookup list. An element is a field value and comment (helpful description that does not affect the lookup functionally).

Authorizations:

X-API-TOKEN

path Parameters

lookupListId

required

string

Example: 7c985e09-3db6-5dc6-ae33-58403493e13f

GUID of the lookup list.

Request Body schema: application/json

value required	string [ 1 .. 80 ] characters A single field value.
comment	string [ 0 .. 200 ] characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the element in the Lookup list.
value	string [ 1 .. 80 ] characters A single field value. You should ensure that the lookup list contains a list of values all mapped to the same field.
comment	string <= 200 characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 0,
"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}

Get all/Search lookup elements

post /v1/lookup-lists/{lookupListId}/elements/search

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{lookupListId}/elements/search

Searches elements in a specified lookup list. Can also be run without a filter to return the full list of elements. Returns a paginated list of results.

Authorizations:

X-API-TOKEN

path Parameters

lookupListId

required

string

Example: 7c985e09-3db6-5dc6-ae33-58403493e13f

GUID of the lookup list.

Request Body schema: application/json

filter	object (LookupListElementsFilter) Filter for elements by value, element ID, or by comments that contain a search term. If multiple properties are sent, they must all be satisfied (`AND` logic).
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Responses

200

successful operation

Response Schema: application/json

total	integer <int32> Total number of search results. The results are relvent elements contained in the lookup list.
results	Array of objects (LookupListElement)
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"filter": 
{"searchTerm": "server",
"byIds": 
[0
],
"byValues": 
["string"
]
},
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"total": 0,
"results": 
[
{"id": 0,
"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Get element

get /v1/lookup-lists/{lookupListId}/elements/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Retrieves a specific lookup element by its ID.

Authorizations:

X-API-TOKEN

path Parameters

lookupListId required	string Example: 7c985e09-3db6-5dc6-ae33-58403493e13f GUID of the lookup list.
id required	integer <int32> Example: 20 ID of a specific value element contained in the lookup list.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the element in the Lookup list.
value	string [ 1 .. 80 ] characters A single field value. You should ensure that the lookup list contains a list of values all mapped to the same field.
comment	string <= 200 characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 0,
"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}

Update element

put /v1/lookup-lists/{lookupListId}/elements/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Changes the value and/or comment of a specific element, identified by its ID.

Authorizations:

X-API-TOKEN

path Parameters

lookupListId required	string Example: 7c985e09-3db6-5dc6-ae33-58403493e13f GUID of the lookup list.
id required	integer <int32> Example: 20 ID of a specific value element contained in the lookup list.

Request Body schema: application/json

id	integer <int32> ID of the element in the Lookup list.
value	string [ 1 .. 80 ] characters A single field value. You should ensure that the lookup list contains a list of values all mapped to the same field.
comment	string <= 200 characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the element in the Lookup list.
value	string [ 1 .. 80 ] characters A single field value. You should ensure that the lookup list contains a list of values all mapped to the same field.
comment	string <= 200 characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"id": 0,
"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 0,
"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}

Delete element

delete /v1/lookup-lists/{lookupListId}/elements/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{lookupListId}/elements/{id}

Deletes a specific lookup element, identified by its ID.

Authorizations:

X-API-TOKEN

path Parameters

lookupListId required	string Example: 7c985e09-3db6-5dc6-ae33-58403493e13f GUID of the lookup list.
id required	integer <int32> Example: 20 ID of a specific value element contained in the lookup list.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the element in the Lookup list.
value	string [ 1 .. 80 ] characters A single field value. You should ensure that the lookup list contains a list of values all mapped to the same field.
comment	string <= 200 characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 0,
"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}

Add elements in bulk

post /v1/lookup-lists/{lookupListId}/elements/bulk-add

US East (Northern Virginia)

https://api.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

Canada (Central)

https://api-ca.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

Europe (London)

https://api-uk.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

West US 2 (Washington)

https://api-wa.layerlog.com/v1/lookup-lists/{lookupListId}/elements/bulk-add

Adds an array of elements to an existing Lookup list and sets the expiration date for the lookup.

Authorizations:

X-API-TOKEN

path Parameters

lookupListId

required

string

Example: 7c985e09-3db6-5dc6-ae33-58403493e13f

GUID of the lookup list.

query Parameters

defaultTTL

integer <int64>

Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Request Body schema: application/json

Array

value required	string [ 1 .. 80 ] characters A single field value.
comment	string [ 0 .. 200 ] characters Optional. A place to add a note or additional details about the value. For example, if the value is an IP address, the comment can identify the server.
expirationDate	integer <int64> Optional. The expiration date and time of the lookup list as UNIX epoch milliseconds. When this parameter is left empty, the lookup list does not expire.

Responses

200

successful operation

Response Schema: application/json

status	string Enum: "SUCCESS" "PARTIAL_FAILED" "FAILED" Returns the status of the request.
numOfAddedElements	integer <int32> Total number of new elements added to the Lookup list.
numOfMergedElements	integer <int32> Total number of elements merged with duplicate values in the existing list. (In other words, the number of existing elements that were updated by the request.)

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


[
{"value": "54.53.1.1",
"comment": "ABC Server",
"expirationDate": 0
}
]

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"status": "SUCCESS",
"numOfAddedElements": 32,
"numOfMergedElements": 42
}

Manage users

Retrieve users in all associated accounts

get /v1/user-management/recursive

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/recursive

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/recursive

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/recursive

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/recursive

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/recursive

Europe (London)

https://api-uk.layerlog.com/v1/user-management/recursive

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/recursive

Returns a list of users in the main account and all associated sub accounts as an array of JSON objects per account.

If a user appears in multiple accounts, it will be listed separately under each account.

Note: Must be run with an API token belonging to the main account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> ID of the user
username	string Email address used to sign in to Layerlog
fullName	string First and last name of the user
accountID	integer <int32> Layerlog account ID.
role	string User role. Can be `USER_ROLE_READONLY`, `USER_ROLE_REGULAR` or `USER_ROLE_ACCOUNT_ADMIN`.
active	boolean If the user is active, `true`. If the user is suspended, `false`.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/user-management/recursive" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 33265,
"username": "steve@winslows.com",
"fullName": "Stefan Urkel",
"accountID": 55555,
"role": "USER_ROLE_READONLY",
"active": true
}
]

Retrieve all users

get /v1/user-management

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management

Canada (Central)

https://api-ca.layerlog.com/v1/user-management

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management

Europe (London)

https://api-uk.layerlog.com/v1/user-management

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management

Returns a list of users as an array of JSON objects.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> ID of the user
username	string Email address used to sign in to Layerlog
fullName	string First and last name of the user
accountID	integer <int32> Layerlog account ID.
role	string User role. Can be `USER_ROLE_READONLY`, `USER_ROLE_REGULAR` or `USER_ROLE_ACCOUNT_ADMIN`.
active	boolean If the user is active, `true`. If the user is suspended, `false`.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/user-management" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 33265,
"username": "steve@winslows.com",
"fullName": "Stefan Urkel",
"accountID": 55555,
"role": "USER_ROLE_READONLY",
"active": true
}
]

Create a user

post /v1/user-management

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management

Canada (Central)

https://api-ca.layerlog.com/v1/user-management

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management

Europe (London)

https://api-uk.layerlog.com/v1/user-management

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management

Creates a new user with specified permissions to access your log data

Authorizations:

X-API-TOKEN

Request Body schema: application/json

username required	string ^[_A-Za-z0-9-\+]+(\.[_A-Za-z0-9-]+)@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)(\.[A-Za-z]{2,})$ Email address used to sign in to Layerlog
fullName required	string The user's first and last name
accountID required	integer <int32> ID of the account attached to the user
role	string User role. Can be `USER_ROLE_READONLY`, `USER_ROLE_REGULAR` or `USER_ROLE_ACCOUNT_ADMIN`.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the user

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"username": "drvenkman@gbusters.com",
"fullName": "Peter Venkman",
"accountID": 0,
"role": "USER_ROLE_READONLY"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 13485
}

Retrieve a user by ID

get /v1/user-management/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/{id}

Europe (London)

https://api-uk.layerlog.com/v1/user-management/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/{id}

Returns user information and permissions as a JSON object

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the user

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the user
username	string Email address used to sign in to Layerlog
fullName	string First and last name of the user
accountID	integer <int32> Layerlog account ID.
role	string User role. Can be `USER_ROLE_READONLY`, `USER_ROLE_REGULAR` or `USER_ROLE_ACCOUNT_ADMIN`.
active	boolean If the user is active, `true`. If the user is suspended, `false`.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/user-management/55555" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 33265,
"username": "steve@winslows.com",
"fullName": "Stefan Urkel",
"accountID": 55555,
"role": "USER_ROLE_READONLY",
"active": true
}

Update a user

put /v1/user-management/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/{id}

Europe (London)

https://api-uk.layerlog.com/v1/user-management/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/{id}

Changes an existing user's details or permissions.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 11300

ID of the user

Request Body schema: application/json

username required	string ^[_A-Za-z0-9-\+]+(\.[_A-Za-z0-9-]+)@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)(\.[A-Za-z]{2,})$ Email address used to sign in to Layerlog
fullName required	string The user's first and last name
accountID required	integer <int32> ID of the account attached to the user
role	string User role. Can be `USER_ROLE_READONLY`, `USER_ROLE_REGULAR` or `USER_ROLE_ACCOUNT_ADMIN`.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the user

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"username": "drvenkman@gbusters.com",
"fullName": "Peter Venkman",
"accountID": 0,
"role": "USER_ROLE_READONLY"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 13485
}

Delete a user

delete /v1/user-management/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/{id}

Europe (London)

https://api-uk.layerlog.com/v1/user-management/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/{id}

Revokes a user's access to the account. The API token determines the account the user will be deleted from.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 11300

ID of the user

Responses

200

successful operation

Request samples

cURL

Copy

curl -X DELETE "https://api.layerlog.com/v1/user-management/11300" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Delete a user from all accounts

delete /v1/user-management/{id}/recursive

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/{id}/recursive

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/{id}/recursive

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/{id}/recursive

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/{id}/recursive

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/{id}/recursive

Europe (London)

https://api-uk.layerlog.com/v1/user-management/{id}/recursive

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/{id}/recursive

Deletes a user from the main account and all associated sub accounts. Must be run with an API token for the main account.

The user will not be deleted from accounts for which there are no other users. In other words, any accounts where the user is the last user will be skipped. The success message will list accounts that were skipped.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 11300

ID of the user

Responses

200

successful operation

Request samples

cURL

Copy

curl -X DELETE "https://api.layerlog.com/v1/user-management/11300/recursive" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Suspend a user

post /v1/user-management/suspend/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/suspend/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/suspend/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/suspend/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/suspend/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/suspend/{id}

Europe (London)

https://api-uk.layerlog.com/v1/user-management/suspend/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/suspend/{id}

Locks a user's access to your accounts

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 3325

ID of the user

Responses

200

successful operation

Request samples

cURL

Copy

curl -X POST "https://api.layerlog.com/v1/user-management/suspend/11300" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Unsuspend a user

post /v1/user-management/unsuspend/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/unsuspend/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/unsuspend/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/unsuspend/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/unsuspend/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/unsuspend/{id}

Europe (London)

https://api-uk.layerlog.com/v1/user-management/unsuspend/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/unsuspend/{id}

Restores a suspended user's access to your accounts

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 3325

ID of the user

Responses

200

successful operation

Request samples

cURL

Copy

curl -X POST "https://api.layerlog.com/v1/user-management/unsuspend/11300" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Suspend a user from all accounts

put /v1/user-management/{id}/suspend/recursive

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/{id}/suspend/recursive

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/{id}/suspend/recursive

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/{id}/suspend/recursive

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/{id}/suspend/recursive

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/{id}/suspend/recursive

Europe (London)

https://api-uk.layerlog.com/v1/user-management/{id}/suspend/recursive

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/{id}/suspend/recursive

Suspends a user from the main account and all associated sub accounts. Must be run with an API token for the main account. The user will not be suspended from accounts for which there are no other users. In other words, any accounts where the user is the last user will be skipped. The success message will list accounts that were skipped.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 11300

ID of the user

Responses

200

successful operation

Response Schema: application/json

message

string

Request samples

cURL

Copy

curl -X PUT "https://api.layerlog.com/v1/user-management/11300/suspend/recursive" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Finished suspending user 11300 from accounts."
}

Unsuspend a user from all accounts

put /v1/user-management/{id}/unsuspend/recursive

US East (Northern Virginia)

https://api.layerlog.com/v1/user-management/{id}/unsuspend/recursive

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/user-management/{id}/unsuspend/recursive

Canada (Central)

https://api-ca.layerlog.com/v1/user-management/{id}/unsuspend/recursive

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/user-management/{id}/unsuspend/recursive

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/user-management/{id}/unsuspend/recursive

Europe (London)

https://api-uk.layerlog.com/v1/user-management/{id}/unsuspend/recursive

West US 2 (Washington)

https://api-wa.layerlog.com/v1/user-management/{id}/unsuspend/recursive

Unsuspends a user from the main account and all associated sub accounts. Must be run with an API token for the main account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 11300

ID of the user

Responses

200

successful operation

Response Schema: application/json

message

string

Request samples

cURL

Copy

curl -X PUT "https://api.layerlog.com/v1/user-management/11300/suspend/recursive" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Finished unsuspending user 11300 from accounts."
}

Authentication groups

Get authentication groups

get /v1/authentication/groups

US East (Northern Virginia)

https://api.layerlog.com/v1/authentication/groups

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/authentication/groups

Canada (Central)

https://api-ca.layerlog.com/v1/authentication/groups

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/authentication/groups

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/authentication/groups

Europe (London)

https://api-uk.layerlog.com/v1/authentication/groups

West US 2 (Washington)

https://api-wa.layerlog.com/v1/authentication/groups

Returns a list of all existing authentication groups

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

group	string Group name
userRole	string User role

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/authentication/groups" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"group": "group",
"userRole": "role"
}
]

Create/update authentication groups

post /v1/authentication/groups

US East (Northern Virginia)

https://api.layerlog.com/v1/authentication/groups

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/authentication/groups

Canada (Central)

https://api-ca.layerlog.com/v1/authentication/groups

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/authentication/groups

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/authentication/groups

Europe (London)

https://api-uk.layerlog.com/v1/authentication/groups

West US 2 (Washington)

https://api-wa.layerlog.com/v1/authentication/groups

Creates/updates existing authentication groups. To create or update groups, you need to send all these groups in the payload. With every update, all running user sessions will be terminated, so the users need to login again. To delete a group, you need to exclude this group from the payload that you send to update groups. With every deletion, all running user sessions will be terminated, so the users need to login again.

Example 1. Create groups called group1 and group2. The payload will contain [ { \"group\": \”group1\”, \"userRole\": \”USER_ROLE_READONLY\” }, { \"group\": \”group2\”, \"userRole\": \”USER_ROLE_ADMIN\” }]. As a result, the two groups will be created with specified permissions.

Example 2. Update existing groups called group1 and group2. The payload will contain [ { \"group\": \”group1\”, \"userRole\": \”USER_ROLE_ADMIN” }, { \"group\": \”group2\”, \"userRole\": \”USER_ROLE_READONLY\” }]. As a result, the two groups will be updated with specified permissions.

Example 3. Delete group called group1 from the existing two groups: group1 and group2. The payload will contain [{ \"group\": \”group2\”, \"userRole\": \”USER_ROLE_READONLY\” }]. As a result, group1 will be deleted, as it is excluded from the payload.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

Array

group	string Group name
userRole	string User role

Responses

200

successful operation

Response Schema: application/json

Array

group	string Group name
userRole	string User role

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


[
{"group": "group",
"userRole": "role"
}
]

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"group": "group",
"userRole": "role"
}
]

Who am I

Retrieve account information

get /v2/whoami

US East (Northern Virginia)

https://api.layerlog.com/v2/whoami

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/whoami

Canada (Central)

https://api-ca.layerlog.com/v2/whoami

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/whoami

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/whoami

Europe (London)

https://api-uk.layerlog.com/v2/whoami

West US 2 (Washington)

https://api-wa.layerlog.com/v2/whoami

Returns the account name as a string and the account ID as an integer. Good for testing or for confirming that you’re using an API token from the right account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

accountName	string Name of the account
accountId	integer <int32> ID of the account

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v2/whoami" -H "Content-Type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"accountName": "Jean Valjean",
"accountId": 24601
}

Manage time-based log accounts

Use these API requests to manage time-based log accounts:

Create, update, or delete a sub account.
Allocate daily capacity to the main account and/or sub accounts.
Retrieve account activity stats and/or account configuration details.

Flexible storage & shared volume

Flexible storage and shared volume allow accounts to share indexing capacity.

To enable shared volume, go to the Manage accounts page in the Layerlog app and toggle the button Use flexible volume to turn it on.

To determine whether flexible storage is enabled, run a Get request to retrieve account details.

If isFlexible is true, flexible storage is enabled and every account has reserved capacity set by the parameter reservedDailyGB.
If false, flexible storage is disabled and the parameter reservedDailyGB is null.

Retrieve settings for all accounts

get /v1/account-management/time-based-accounts

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts

Returns account settings for the main account and all of its associated sub accounts.

The list of accounts is returned as an array of JSON objects.
Must be run with an API token from the main account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

accountId	integer <int32> ID of the account
email	any Nullable Email address of the user who created the account
accountName	string Name of the account
isFlexible	boolean Default: false Indicates whether the plan has shared volume enabled. If `true`, the volume of data that the account can index per calendar day is determined by 2 parameters: `reservedDailyGB` (Required) and `maxDailyGB` (Optional, can be null). If `false`, the volume of data that the account can index per calendar day is determined only by `maxDailyGB`. The parameter `reservedDailyGB` does not apply and should be null.
reservedDailyGB	number <float> Default: null If `isFlexible=false`, this field does not apply and will be null. If `isFlexible=true`, this determines the daily volume in GBs that is reserved for the account.
maxDailyGB	number <float> The maximum volume of data that an account can index per calendar day. If `isFlexible=false` this is the only capacity reserved for use by the account. Cannot be null. If `isFlexible=true` this is used to limit the account's access to shared volume. Once the data shipped to the account exceeds the account's reserved capacity, the account can continue to index data up to its `maxDailyGB`, as long as shared volume is available. If null (and `isFlexible=true`), the account is uncapped and can continue to index data as long as shared volume is available.
retentionDays	integer <int32> How long log data is retained in the Elasticsearch Index and searchable in Kibana, in days.
searchable	boolean (Searchable) Default: false If other accounts can search this account's logs, `true`. Otherwise, `false`.
accessible	boolean (Accessible) Default: false If users of the main account can access this account, `true`. Otherwise, `false`.
docSizeSetting	boolean (DocSizeSetting) Default: false If document size is attached to logs, `true`. Otherwise, `false`.
sharingObjectsAccounts	Array of objects (SharingAccount) Accounts that have permissions to access this account's Kibana objects.
utilizationSettings	object (AccountUtilizationSettings) Settings for logging metrics on your account utilization, such as used and expected data volume at current indexing rate.

Request samples

cURL

Copy

curl --request GET --url "https://api.layerlog.com/v1/account-management/time-based-accounts" --header "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"accountId": 99999,
"email": null,
"accountName": "404 errors",
"isFlexible": true,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 5,
"searchable": true,
"accessible": false,
"docSizeSetting": true,
"sharingObjectsAccounts": 
[
{"accountId": 88888,
"accountName": "dev group 8"
}
],
"utilizationSettings": 
{"frequencyMinutes": 5,
"utilizationEnabled": true
}
}
]

Create a sub account

post /v1/account-management/time-based-accounts

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts

Creates a new logging sub account. Must be run with an API token from the main account.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

email required	string ^[_A-Za-z0-9-\+]+(\.[_A-Za-z0-9-]+)@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)(\.[A-Za-z]{2,})$ Account administrator's email address
accountName required	string Name of the account
isFlexible	boolean Default: false
reservedDailyGB	number <float> Default: null If `isFlexible=false`, don't send this field or send it null. If `isFlexible=true`, this parameter is required. It determines the volume that is reserved for the account.
maxDailyGB	number <float> The maximum volume of data that an account can index per calendar day. If `isFlexible=false` this is the only capacity reserved for use by the account. Cannot be null. If `isFlexible=true` this is used to limit the account's access to shared volume. Once the data shipped to the account exceeds the account's reserved capacity, the account can continue to index data up to its `maxDailyGB`, as long as shared volume is available. If null (and `isFlexible=true`), the account is uncapped and can continue to index data as long as shared volume is available.
retentionDays required	integer <int32> >= 1 How long log data is stored and searchable in Kibana, in days.
searchable	boolean (Searchable) Default: false If other accounts can search this account's logs, `true`. Otherwise, `false`.
accessible	boolean (Accessible) Default: false If users of the main account can access this account, `true`. Otherwise, `false`.
sharingObjectsAccounts required	Array of integers <int32> IDs of accounts that can access this account's data. The array is required, but can be empty.
docSizeSetting	boolean (DocSizeSetting) Default: false If document size is attached to logs, `true`. Otherwise, `false`.
utilizationSettings	object (AccountUtilizationSettings) Settings for logging metrics on your account utilization, such as used and expected data volume at current indexing rate.

Responses

200

successful operation

Response Schema: application/json

accountId

integer <int32>

ID of the account

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"email": "destek@layerlog.com",
"accountName": "AWS Lambda svr 3",
"isFlexible": false,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 5,
"searchable": true,
"accessible": false,
"sharingObjectsAccounts": 
[
[
[88888,
55555
],
[ ]
]
],
"docSizeSetting": true,
"utilizationSettings": 
{"frequencyMinutes": 5,
"utilizationEnabled": true
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"accountId": 99999
}

Retrieve account settings by ID

get /v1/account-management/time-based-accounts/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts/{id}

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts/{id}

Returns account configuration settings as a JSON object. Must be run with an API token from the main account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 99999

ID of the account to retrieve

Responses

200

successful operation

Response Schema: application/json

accountId	integer <int32> ID of the account
email	any Nullable Email address of the user who created the account
accountName	string Name of the account
isFlexible	boolean Default: false Indicates whether the plan has shared volume enabled. If `true`, the volume of data that the account can index per calendar day is determined by 2 parameters: `reservedDailyGB` (Required) and `maxDailyGB` (Optional, can be null). If `false`, the volume of data that the account can index per calendar day is determined only by `maxDailyGB`. The parameter `reservedDailyGB` does not apply and should be null.
reservedDailyGB	number <float> Default: null If `isFlexible=false`, this field does not apply and will be null. If `isFlexible=true`, this determines the daily volume in GBs that is reserved for the account.
maxDailyGB	number <float> The maximum volume of data that an account can index per calendar day. If `isFlexible=false` this is the only capacity reserved for use by the account. Cannot be null. If `isFlexible=true` this is used to limit the account's access to shared volume. Once the data shipped to the account exceeds the account's reserved capacity, the account can continue to index data up to its `maxDailyGB`, as long as shared volume is available. If null (and `isFlexible=true`), the account is uncapped and can continue to index data as long as shared volume is available.
retentionDays	integer <int32> How long log data is retained in the Elasticsearch Index and searchable in Kibana, in days.
searchable	boolean (Searchable) Default: false If other accounts can search this account's logs, `true`. Otherwise, `false`.
accessible	boolean (Accessible) Default: false If users of the main account can access this account, `true`. Otherwise, `false`.
docSizeSetting	boolean (DocSizeSetting) Default: false If document size is attached to logs, `true`. Otherwise, `false`.
sharingObjectsAccounts	Array of objects (SharingAccount) Accounts that have permissions to access this account's Kibana objects.
utilizationSettings	object (AccountUtilizationSettings) Settings for logging metrics on your account utilization, such as used and expected data volume at current indexing rate.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/account-management/time-based-accounts/99999" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"accountId": 99999,
"email": null,
"accountName": "404 errors",
"isFlexible": true,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 5,
"searchable": true,
"accessible": false,
"docSizeSetting": true,
"sharingObjectsAccounts": 
[
{"accountId": 88888,
"accountName": "dev group 8"
}
],
"utilizationSettings": 
{"frequencyMinutes": 5,
"utilizationEnabled": true
}
}

Update an account

put /v1/account-management/time-based-accounts/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts/{id}

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts/{id}

Updates the account settings of a main account or sub account, with some exceptions, noted below:

For the main account, the parameter retentionDays cannot be updated. It is determined by the plan you purchased.
For the main account, if isFlexible=false, the parameters maxDailyGB and reservedDailyGB cannot be updated using this endpoint.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 99999

ID of the account to update

Request Body schema: application/json

accountName required	string Name of the account
reservedDailyGB	number <float> Default: null If `isFlexible=false`, this field does not apply. Leave it null. If `isFlexible=true`, this parameter is required. It determines the volume that is reserved for the account.
maxDailyGB	number <float> The maximum volume of data that an account can index per calendar day. If `isFlexible=false` this parameter can only be used to update a sub account, but not a main account. It determines the only capacity reserved for use by the account. It cannot be null. If `isFlexible=true` this is used to limit the account's access to shared volume. Once the data shipped to the account exceeds the account's reserved capacity, the account can continue to index data up to its `maxDailyGB`, as long as shared volume is available. If null (and `isFlexible=true`), the account is uncapped and can continue to index data as long as shared volume is available.
retentionDays	integer <int32> >= 1 This is how long log data is stored and searchable in Kibana, in days.
searchable	boolean (Searchable) Default: false If other accounts can search this account's logs, `true`. Otherwise, `false`.
accessible	boolean (Accessible) Default: false If users of the main account can access this account, `true`. Otherwise, `false`.
sharingObjectsAccounts required	Array of integers <int32> IDs of accounts that can access this account's data. The array is required, but can be empty.
docSizeSetting	boolean (DocSizeSetting) Default: false If document size is attached to logs, `true`. Otherwise, `false`.
utilizationSettings	object (AccountUtilizationSettings) Settings for logging metrics on your account utilization, such as used and expected data volume at current indexing rate.

Responses

204

successful operation

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"accountName": "AWS Lambda svr 3",
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 5,
"searchable": true,
"accessible": false,
"sharingObjectsAccounts": 
[
[
[88888,
55555
],
[ ]
]
],
"docSizeSetting": true,
"utilizationSettings": 
{"frequencyMinutes": 5,
"utilizationEnabled": true
}
}

Delete a sub account

delete /v1/account-management/time-based-accounts/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts/{id}

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts/{id}

Deletes a sub account by its account ID. Must be run with an API token from the main account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 99999

ID of the account to be deleted.

Responses

204

successful operation

Request samples

cURL

Copy

curl -X DELETE "https://api.layerlog.com/v1/account-management/time-based-accounts/88888" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Retrieve detailed information for all accounts

get /v1/account-management/time-based-accounts/detailed

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts/detailed

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts/detailed

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts/detailed

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts/detailed

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts/detailed

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts/detailed

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts/detailed

Returns detailed account information for the main account and all of its associated sub accounts. Information includes usage and sharing permissions for Kibana objects.

The list of accounts is returned as an array of JSON objects. Each sub account is its own object.
Must be run with an API token from the main account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

subAccountRelation	object (SubAccountRelation) Properties of the sub accounts related to this main account
account	object (AccountView)
sharingObjectsAccounts	Array of objects (AccountView)
utilizationSettings	object (AccountUtilizationSettings) Settings for logging metrics on your account utilization, such as used and expected data volume at current indexing rate.
dailyUsagesList	object (DailyUsagesList)
docSizeSetting	boolean (DocSizeSetting) Default: false If document size is attached to logs, `true`. Otherwise, `false`.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/account-management/time-based-accounts/detailed" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"subAccountRelation": 
{"ownerAccountId": 88765,
"subAccountId": 89234,
"searchable": true,
"accessible": false,
"createdDate": 1627489797000,
"lastUpdatedDate": 1627489797000,
"lastUpdaterUserId": 33342,
"type": "SUB_ACCOUNT"
},
"account": 
{"accountId": 0,
"accountName": "string",
"accountToken": "string",
"active": true,
"esIndexPrefix": "string",
"isFlexible": true,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 0
},
"sharingObjectsAccounts": 
[
{"accountId": 0,
"accountName": "string",
"accountToken": "string",
"active": true,
"esIndexPrefix": "string",
"isFlexible": true,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 0
}
],
"utilizationSettings": 
{"frequencyMinutes": 5,
"utilizationEnabled": true
},
"dailyUsagesList": 
{"usage": 
[
{"date": 0,
"bytes": 0
}
]
},
"docSizeSetting": true
}
]

Retrieve detailed account information by account ID

get /v1/account-management/time-based-accounts/detailed/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

Europe (London)

https://api-uk.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account-management/time-based-accounts/detailed/{id}

Returns detailed account information. Must be run with an API token from the main account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 99999

ID of the account to retrieve

Responses

200

successful operation

Response Schema: application/json

subAccountRelation	object (SubAccountRelation) Properties of the sub accounts related to this main account
account	object (AccountView)
sharingObjectsAccounts	Array of objects (AccountView)
utilizationSettings	object (AccountUtilizationSettings) Settings for logging metrics on your account utilization, such as used and expected data volume at current indexing rate.
dailyUsagesList	object (DailyUsagesList)
docSizeSetting	boolean (DocSizeSetting) Default: false If document size is attached to logs, `true`. Otherwise, `false`.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/account-management/time-based-accounts/detailed/99999" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"subAccountRelation": 
{"ownerAccountId": 88765,
"subAccountId": 89234,
"searchable": true,
"accessible": false,
"createdDate": 1627489797000,
"lastUpdatedDate": 1627489797000,
"lastUpdaterUserId": 33342,
"type": "SUB_ACCOUNT"
},
"account": 
{"accountId": 0,
"accountName": "string",
"accountToken": "string",
"active": true,
"esIndexPrefix": "string",
"isFlexible": true,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 0
},
"sharingObjectsAccounts": 
[
{"accountId": 0,
"accountName": "string",
"accountToken": "string",
"active": true,
"esIndexPrefix": "string",
"isFlexible": true,
"reservedDailyGB": 3,
"maxDailyGB": 5,
"retentionDays": 0
}
],
"utilizationSettings": 
{"frequencyMinutes": 5,
"utilizationEnabled": true
},
"dailyUsagesList": 
{"usage": 
[
{"date": 0,
"bytes": 0
}
]
},
"docSizeSetting": true
}

Manage shared tokens

You can share Kibana visualization and dashboard snapshots using shared tokens. Token filters are available to help you control what data to expose.

Note: Shared token endpoints require permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Retrieve all shared token filters

get /v1/shared-tokens/filters

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/filters

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/filters

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/filters

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/filters

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/filters

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/filters

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/filters

Returns an array of JSON objects, where each object shows information for a shared token filter.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> ID of the shared token filter
field required	string ^[a-zA-Z0-9_@.-]+$ The field to filter
value required	string ^[a-zA-Z0-9_@.-]+$ The filter query
description	string Name of the filter

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/shared-tokens/filters" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 339,
"field": "string",
"value": "string",
"description": "503 responses"
}
]

Create a shared token filter

post /v1/shared-tokens/filters

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/filters

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/filters

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/filters

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/filters

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/filters

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/filters

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/filters

Creates a new shared token filter.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

id	integer <int32> ID of the shared token filter
field required	string ^[a-zA-Z0-9_@.-]+$ The field to filter
value required	string ^[a-zA-Z0-9_@.-]+$ The filter query
description	string Name of the filter

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the shared token filter
field required	string ^[a-zA-Z0-9_@.-]+$ The field to filter
value required	string ^[a-zA-Z0-9_@.-]+$ The filter query
description	string Name of the filter

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"id": 339,
"field": "string",
"value": "string",
"description": "503 responses"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 339,
"field": "string",
"value": "string",
"description": "503 responses"
}

Retrieve a shared token filter by ID

get /v1/shared-tokens/filters/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/filters/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/filters/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/filters/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/filters/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/filters/{id}

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/filters/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/filters/{id}

Returns a shared token filter as a JSON object.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the shared token filter

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the shared token filter
field required	string ^[a-zA-Z0-9_@.-]+$ The field to filter
value required	string ^[a-zA-Z0-9_@.-]+$ The filter query
description	string Name of the filter

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/shared-tokens/filters/345" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 339,
"field": "string",
"value": "string",
"description": "503 responses"
}

Delete a shared token filter

delete /v1/shared-tokens/filters/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/filters/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/filters/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/filters/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/filters/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/filters/{id}

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/filters/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/filters/{id}

Deletes a shared token filter.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the shared token filter

Responses

200

successful operation

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

cURL

Copy

curl -X DELETE "https://api.layerlog.com/v1/shared-tokens/filters/345" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "token with id 12345 not found for account 54321"
}

Retrieve a shared token by ID

get /v1/shared-tokens/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/{id}

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/{id}

Returns a shared token as a JSON object.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the shared token

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the shared token
name	string Descriptive name of the token
token	string The token
filters	Array of integers <int32> Array of filter IDs attached to each token. If no filter is attached, `null`.

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/shared-tokens/1242" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1241,
"name": "Snapshotting token",
"token": "6c36edf51-cf93883aa35-5bc6ce6-7bcfe60d87",
"filters": 
[339,
340
]
}

Update a shared token

put /v1/shared-tokens/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/{id}

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/{id}

Changes the filters attached to a shared token.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Request Body schema: application/json

filters

required

Array of integers <int32>

IDs of filters to attach to the token. To remove all filters, use an empty array [].

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the shared token
name	string Descriptive name of the token
token	string The token
filters	Array of integers <int32> Array of filter IDs attached to each token. If no filter is attached, `null`.

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"filters": 
[339
]
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1241,
"name": "Snapshotting token",
"token": "6c36edf51-cf93883aa35-5bc6ce6-7bcfe60d87",
"filters": 
[339,
340
]
}

Delete a shared token

delete /v1/shared-tokens/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens/{id}

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens/{id}

Deletes a shared token.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the shared token

Responses

204

successful operation

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

cURL

Copy

curl -X DELETE "https://api.layerlog.com/v1/shared-tokens/1250" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "token with id 12345 not found for account 54321"
}

Retrieve all shared tokens

get /v1/shared-tokens

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens

Returns an array of JSON objects, where each object shows information for a shared token.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> ID of the shared token
name	string Descriptive name of the token
token	string The token
filters	Array of integers <int32> Array of filter IDs attached to each token. If no filter is attached, `null`.

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/shared-tokens" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 1241,
"name": "Snapshotting token",
"token": "6c36edf51-cf93883aa35-5bc6ce6-7bcfe60d87",
"filters": 
[339,
340
]
}
]

Create a shared token

post /v1/shared-tokens

US East (Northern Virginia)

https://api.layerlog.com/v1/shared-tokens

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/shared-tokens

Canada (Central)

https://api-ca.layerlog.com/v1/shared-tokens

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/shared-tokens

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/shared-tokens

Europe (London)

https://api-uk.layerlog.com/v1/shared-tokens

West US 2 (Washington)

https://api-wa.layerlog.com/v1/shared-tokens

Creates a new shared token.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

tokenName	string Default: "string" Name of the token
filters	Array of integers <int32> IDs of filters to attach to the token

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the shared token
name	string Descriptive name of the token
token	string The token
filters	Array of integers <int32> Array of filter IDs attached to each token. If no filter is attached, `null`.

400

not found

Response Schema: application/json

message

string

The shared token or query filter could not be found

403

forbidden

Response Schema: application/json

message

string

Insufficient privileges. Contact our Support team for access to this API feature.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"tokenName": "Support team token",
"filters": 
[339
]
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1241,
"name": "Snapshotting token",
"token": "6c36edf51-cf93883aa35-5bc6ce6-7bcfe60d87",
"filters": 
[339,
340
]
}

Manage API tokens

You can manage API tokens for sub accounts.

Create a sub account API token.

post /v1/api-tokens/sub-account

US East (Northern Virginia)

https://api.layerlog.com/v1/api-tokens/sub-account

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/api-tokens/sub-account

Canada (Central)

https://api-ca.layerlog.com/v1/api-tokens/sub-account

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/api-tokens/sub-account

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/api-tokens/sub-account

Europe (London)

https://api-uk.layerlog.com/v1/api-tokens/sub-account

West US 2 (Washington)

https://api-wa.layerlog.com/v1/api-tokens/sub-account

Creates a new API token for a sub account. Must be run with an API token of the owner account. Once created, you can view the details for this new token in Manage tokens > API tokens, when you are logged in to the relevant sub account.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

name	string Default: "string" The name provided in the request for a new API token for the sub account
accountId	integer <int32> Layerlog sub account ID.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the newly created API token for the sub account
name	string The name of the newly created API token for the sub account. Uses the name provided in the request.
token	string The API token
createdAt	Instant The time at which the new sub account API token was created

400

Bad Request

Response Schema: application/json

message

string

Bad Request. The request cannot be completed. Errors may include malformed request syntax, invalid request message parameters, and so on.

401

Unauthorized

Response Schema: application/json

message

string

Unauthorized. Attempted to create an API token for a sub account with insufficient or missing credentials for the main or owner account. Please contact our Support team for access to this API feature via destek@layerlog.com.

403

Forbidden

Response Schema: application/json

message

string

Forbidden. Attempted to create an API token for a sub account with an invalid owner account token. This operation requires a valid API token for the owner account.

404

Not Found

Response Schema: application/json

message

string

Not Found. Could not find the sub account associated with this request or the relevant owner account for the sub account.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"name": "newTokenTest999",
"accountId": 160343
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 7386,
"name": "newTokenTest999",
"token": "c498fbc3-a3ac-4676-ad09-689854b5cbbd\"",
"createdAt": 1621858311
}

Manage notification endpoints

Layerlog can send notifications to your preferred workspaces, such as Opsgenie, BigPanda, PagerDuty, and Slack.

Notifications are typically sent when alerts are triggered, when a user shares a Kibana object, or when Layerlog Insights identifies new exceptions in your logs.

Use these API endpoints to create, update, or delete notification endpoints. If you configure a custom endpoint, you can configure the notification message body. Otherwise, you can use any of the available preconfigured endpoints.

Create a Slack endpoint

post /v1/endpoints/slack

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/slack

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/slack

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/slack

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/slack

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/slack

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/slack

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/slack

Creates a new Slack notification endpoint or sends a test message to Slack

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
url	string Your Slack webhook URL

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New Slack endpoint",
"description": "Sends notifications to logzio-alerts channel",
"url": "https://hooks.slack.com/services/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"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update Slack endpoint

put /v1/endpoints/slack/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/slack/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/slack/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/slack/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/slack/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/slack/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/slack/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/slack/{id}

Updates a Slack notification endpoint or sends a test message to Slack

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
url	string Your Slack webhook URL

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New Slack endpoint",
"description": "Sends notifications to logzio-alerts channel",
"url": "https://hooks.slack.com/services/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"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create a custom notification endpoint

post /v1/endpoints/custom

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/custom

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/custom

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/custom

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/custom

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/custom

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/custom

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/custom

Creates a new notification endpoint for a custom integration or sends a test message to the custom endpoint.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
url	string URL where the notification will be sent
method	string The HTTP used to send the notification
headers	string Header parameters to include, as comma-separated key-value pairs
bodyTemplate	object JSON object that serves as the template for the message body.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New custom endpoint",
"description": "Sends notifications to my custom endpoint",
"url": "https://my.custom-endpoint.com",
"method": "POST",
"headers": "authKey=6e30-60a9-3591",
"bodyTemplate": 
{"subject": "Alert from Layerlog",
"message": 
{"severity": "LOW",
"body": "Check Layerlog for log activity"
}
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update a custom notification endpoint

put /v1/endpoints/custom/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/custom/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/custom/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/custom/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/custom/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/custom/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/custom/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/custom/{id}

Updates a new notification endpoint for a custom integration or sends a test message to the custom endpoint.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
url	string URL where the notification will be sent
method	string The HTTP used to send the notification
headers	string Header parameters to include, as comma-separated key-value pairs
bodyTemplate	object JSON object that serves as the template for the message body.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New custom endpoint",
"description": "Sends notifications to my custom endpoint",
"url": "https://my.custom-endpoint.com",
"method": "POST",
"headers": "authKey=6e30-60a9-3591",
"bodyTemplate": 
{"subject": "Alert from Layerlog",
"message": 
{"severity": "LOW",
"body": "Check Layerlog for log activity"
}
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create a PagerDuty endpoint

post /v1/endpoints/pager-duty

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/pager-duty

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/pager-duty

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/pager-duty

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/pager-duty

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/pager-duty

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/pager-duty

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/pager-duty

Creates a new PagerDuty notification endpoint or sends a test message to PagerDuty.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
serviceKey	string API key from PagerDuty

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "PagerDuty endpoint",
"description": "Sends notifications to PagerDuty",
"serviceKey": "94ad63254a1397a51a1ae340c4f10890"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update a PagerDuty endpoint

put /v1/endpoints/pager-duty/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/pager-duty/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/pager-duty/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/pager-duty/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/pager-duty/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/pager-duty/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/pager-duty/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/pager-duty/{id}

Updates a PagerDuty notification endpoint or sends a test message to PagerDuty

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
serviceKey	string API key from PagerDuty

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "PagerDuty endpoint",
"description": "Sends notifications to PagerDuty",
"serviceKey": "94ad63254a1397a51a1ae340c4f10890"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create a BigPanda endpoint

post /v1/endpoints/big-panda

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/big-panda

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/big-panda

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/big-panda

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/big-panda

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/big-panda

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/big-panda

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/big-panda

Creates a new BigPanda notification endpoint or sends a test message to BigPanda.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
apiToken	string API authentication token from BigPanda
appKey	string Application key from BigPanda

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "BigPanda endpoint",
"description": "Sends notifications to BigPanda",
"apiToken": "94ad63254a1397a51a1ae340c4f10890",
"appKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update a BigPanda endpoint

put /v1/endpoints/big-panda/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/big-panda/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/big-panda/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/big-panda/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/big-panda/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/big-panda/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/big-panda/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/big-panda/{id}

Updates a BigPanda notification endpoint or sends a test message to BigPanda

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
apiToken	string API authentication token from BigPanda
appKey	string Application key from BigPanda

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "BigPanda endpoint",
"description": "Sends notifications to BigPanda",
"apiToken": "94ad63254a1397a51a1ae340c4f10890",
"appKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create a Datadog endpoint

post /v1/endpoints/data-dog

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/data-dog

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/data-dog

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/data-dog

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/data-dog

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/data-dog

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/data-dog

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/data-dog

Creates a new Datadog notification endpoint or sends a test message to Datadog.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
apiKey	string API key from Datadog

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "Datadog endpoint",
"description": "Sends notifications to Datadog",
"apiKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update a Datadog endpoint

put /v1/endpoints/data-dog/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/data-dog/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/data-dog/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/data-dog/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/data-dog/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/data-dog/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/data-dog/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/data-dog/{id}

Updates a Datadog notification endpoint or sends a test message to Datadog

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
apiKey	string API key from Datadog

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "Datadog endpoint",
"description": "Sends notifications to Datadog",
"apiKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create a VictorOps endpoint

post /v1/endpoints/victorops

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/victorops

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/victorops

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/victorops

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/victorops

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/victorops

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/victorops

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/victorops

Creates a new VictorOps notification endpoint or sends a test message to VictorOps.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
routingKey required	string Alert routing key from VictorOps
messageType required	string VictorOps REST API `message_type`. For more information, see VictorOps knowledge base.
serviceApiKey required	string API key from VictorOps

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "VictorOps endpoint",
"description": "Sends notifications to VictorOps",
"routingKey": "devops",
"messageType": "WARNING",
"serviceApiKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update a VictorOps endpoint

put /v1/endpoints/victorops/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/victorops/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/victorops/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/victorops/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/victorops/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/victorops/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/victorops/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/victorops/{id}

Updates a VictorOps notification endpoint or sends a test message to VictorOps

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
routingKey required	string Alert routing key from VictorOps
messageType required	string VictorOps REST API `message_type`. For more information, see VictorOps knowledge base.
serviceApiKey required	string API key from VictorOps

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "VictorOps endpoint",
"description": "Sends notifications to VictorOps",
"routingKey": "devops",
"messageType": "WARNING",
"serviceApiKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Retrieve an endpoint by ID

get /v1/endpoints/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/{id}

Returns a JSON object representing a notification endpoint configured in the account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

Responses

200

successful operation

Response Schema: application/json

endpointType	string Enum: "BigPanda" "Slack" "Datadog" "Custom" "PagerDuty" "VictorOps" "Opsgenie" "ServiceNow" "Microsoft Teams" The notification endpoint type that will receive alert messages
id	integer <int32> ID of the notification endpoint
title	string Name of the endpoint
description	string Detailed description of the endpoint

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/endpoints/88" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"endpointType": "Slack",
"id": 88,
"title": "Slack",
"description": "Endpoint for sending alerts to Slack"
}

Delete an endpoint

delete /v1/endpoints/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/{id}

Deletes a notification endpoint

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

Responses

204

successful operation

Request samples

cURL

Copy

curl -X DELETE "https://api.layerlog.com/v1/endpoints/269" -H  "accept: application/json" -H  "content-type: application/json" -H  "X-API-TOKEN: <token>"

Retrieve all notification endpoints

get /v1/endpoints

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints

Europe (London)

https://api-uk.layerlog.com/v1/endpoints

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints

Returns an array of JSON objects. Each object represents a notification endpoint configured in the account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

endpointType	string Enum: "BigPanda" "Slack" "Datadog" "Custom" "PagerDuty" "VictorOps" "Opsgenie" "ServiceNow" "Microsoft Teams" The notification endpoint type that will receive alert messages
id	integer <int32> ID of the notification endpoint
title	string Name of the endpoint
description	string Detailed description of the endpoint

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/endpoints" -H "accept: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"endpointType": "Slack",
"id": 88,
"title": "Slack",
"description": "Endpoint for sending alerts to Slack"
}
]

Create an OpsGenie endpoint

post /v1/endpoints/ops-genie

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/ops-genie

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/ops-genie

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/ops-genie

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/ops-genie

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/ops-genie

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/ops-genie

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/ops-genie

Creates a new OpsGenie notification endpoint or sends a test message to OpsGenie.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
apiKey	string API key from OpsGenie, see https://docs.opsgenie.com/docs/logz-io-integration

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "OpsGenie endpoint",
"description": "Sends notifications to OpsGenie",
"apiKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update an OpsGenie endpoint

put /v1/endpoints/ops-genie/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/ops-genie/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/ops-genie/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/ops-genie/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/ops-genie/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/ops-genie/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/ops-genie/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/ops-genie/{id}

Updates an OpsGenie notification endpoint or sends a test message to OpsGenie.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
apiKey	string API key from OpsGenie, see https://docs.opsgenie.com/docs/logz-io-integration

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "OpsGenie endpoint",
"description": "Sends notifications to OpsGenie",
"apiKey": "c687f9231619d7d7b959f33e4cc821a5"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create an ServiceNow endpoint

post /v1/endpoints/service-now

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/service-now

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/service-now

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/service-now

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/service-now

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/service-now

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/service-now

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/service-now

Creates a new ServiceNow notification endpoint or sends a test message to ServiceNow.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
username	string ServiceNow user name
password	string ServiceNow password
url	string Provide your instance URL to connect to your existing ServiceNow instance, i.e. https://xxxxxxxxx.service-now.com/.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New ServiceNow endpoint",
"description": "Sends notifications to logzio-alerts channel",
"username": "User",
"password": "Password",
"url": "https://my.custom-endpoint.com"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update an ServiceNow endpoint

put /v1/endpoints/service-now/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/service-now/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/service-now/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/service-now/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/service-now/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/service-now/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/service-now/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/service-now/{id}

Updates an ServiceNow notification endpoint or sends a test message to ServiceNow.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
username	string ServiceNow user name
password	string ServiceNow password
url	string Provide your instance URL to connect to your existing ServiceNow instance, i.e. https://xxxxxxxxx.service-now.com/.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New ServiceNow endpoint",
"description": "Sends notifications to logzio-alerts channel",
"username": "User",
"password": "Password",
"url": "https://my.custom-endpoint.com"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Create an Microsoft Teams endpoint

post /v1/endpoints/microsoft-teams

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/microsoft-teams

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/microsoft-teams

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/microsoft-teams

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/microsoft-teams

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/microsoft-teams

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/microsoft-teams

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/microsoft-teams

Creates a new Microsoft Teams notification endpoint or sends a test message to Microsoft Teams.

Authorizations:

X-API-TOKEN

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not created. To create the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
url	string Your Microsoft Teams webhook URL, see https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New Microsoft Teams endpoint",
"description": "Sends notifications to logzio-alerts channel",
"url": "https://my.custom-endpoint.com"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Update an Microsoft Teams endpoint

put /v1/endpoints/microsoft-teams/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/endpoints/microsoft-teams/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/endpoints/microsoft-teams/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/endpoints/microsoft-teams/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/endpoints/microsoft-teams/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/endpoints/microsoft-teams/{id}

Europe (London)

https://api-uk.layerlog.com/v1/endpoints/microsoft-teams/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/endpoints/microsoft-teams/{id}

Updates an Microsoft Teams notification endpoint or sends a test message to Microsoft Teams.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the notification endpoint

query Parameters

test	boolean Default: false To send a test message to the endpoint, `true`. Otherwise, `false`. Note: If set to `true`, the notification endpoint is not updated. To update the endpoint, you need to send the API request where `test=false`.

Request Body schema: application/json

title	string Name of the endpoint
description	string Detailed description of the endpoint
url	string Your Microsoft Teams webhook URL, see https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the notification endpoint. If the API call was made where `test=true`, then no changes are made to the endpoint. In this case, the response body contains `{"id": -1}` to indicate that a test message was sent.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"title": "New Microsoft Teams endpoint",
"description": "Sends notifications to logzio-alerts channel",
"url": "https://my.custom-endpoint.com"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 88
}

Import or export Kibana objects

Export Kibana objects

post /v1/kibana/export

US East (Northern Virginia)

https://api.layerlog.com/v1/kibana/export

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/kibana/export

Canada (Central)

https://api-ca.layerlog.com/v1/kibana/export

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/kibana/export

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/kibana/export

Europe (London)

https://api-uk.layerlog.com/v1/kibana/export

West US 2 (Washington)

https://api-wa.layerlog.com/v1/kibana/export

Exports the configuration of Kibana objects. All objects of a single type (search, visualization, or dashboard) are returned as an array of JSON objects. For example, if you export visualization, each visualization is returned as a JSON object.

You can import objects using the /kibana/import endpoint.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

type

required

string

Enum: "search" "visualization" "dashboard"

The object type to export

Responses

200

successful operation

Response Schema: application/json

kibanaVersion	string The version of Kibana used at the time of export
hits	Array of objects Exported Kibana objects

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"type": "search"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"kibanaVersion": "4.0.0-beta3",
"hits": 
[{ }
]
}

Import Kibana objects

post /v1/kibana/import

US East (Northern Virginia)

https://api.layerlog.com/v1/kibana/import

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/kibana/import

Canada (Central)

https://api-ca.layerlog.com/v1/kibana/import

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/kibana/import

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/kibana/import

Europe (London)

https://api-uk.layerlog.com/v1/kibana/import

West US 2 (Washington)

https://api-wa.layerlog.com/v1/kibana/import

Imports Kibana search, visualization, or dashboard objects. You can export objects using the /kibana/export endpoint.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

kibanaVersion	string The version of Kibana used at the time of export. This must match the current version of Kibana that you're importing to.
override	boolean To update an existing object with the same ID, `true`. Otherwise, `false`. If override is `true`, response message shows overwritten objects as `updated`. If override is `false`, no existing objects are updated, and response message shows these objects as `ignored`.
hits	Array of objects Each JSON object in the array represents a discrete Kibana object. Note: As a best practice, import only objects that were exported from Kibana.

Responses

200

successful operation

Response Schema: application/json

created	Array of strings Name of Kibana objects that were created
updated	Array of strings Names of the Kibana objects that were overwritten. Objects are shown here only if `override` was `true` in the import call.
ignored	Array of strings Names of the Kibana objects that were not overwritten. Objects are shown here only if `override` was `false` in the import call.
failed	Array of strings Names of the Kibana objects that could not be created, updated, or ignored.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"kibanaVersion": "4.0.0-beta3",
"override": false,
"hits": 
[
{"property1": { },
"property2": { }
}
]
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"created": 
["E-commerce-App-Transactions-overtime"
],
"updated": 
["HTTP-Response-over-time"
],
"ignored": 
["Transaction-overtime"
],
"failed": 
["Apache-Response-Over-Time"
]
}

Manage log shipping tokens

Use these API endpoints to create, update, retrieve, or delete log shipping tokens.

Create a log shipping token

post /v1/log-shipping/tokens

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/tokens

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/tokens

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/tokens

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/tokens

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/tokens

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/tokens

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/tokens

Creates a log shipping token for this account.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

name	string Descriptive name for this token.
enabled	boolean Default: true To enable this token, `true`. To disable, `false`.

Responses

201

successful operation

Response Schema: application/json

name	string This token's name.
id	integer <int32> This token's ID.
token	string The token itself.
updatedAt	string Unix timestamp of when this token was last updated.
updatedBy	string Email address of the last user to update this token.
createdAt	string Unix timestamp of when this token was created.
createdBy	string Email address of the user who created this token.
enabled	boolean If this token is enabled, `true`. If it's disabled, `false`.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"name": "staging eu",
"enabled": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"name": "apac prod",
"id": 786351,
"token": "6bLXmMA6FLibc7ySSqNcCfvbhtqT0rPS",
"updatedAt": 414720000,
"updatedBy": "shalom.the.mighty@gmail.com",
"createdAt": 389836800,
"createdBy": "you.got.this@gmail.com",
"enabled": true
}

Retrieve a log shipping token by ID

get /v1/log-shipping/tokens/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/tokens/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/tokens/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/tokens/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/tokens/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/tokens/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/tokens/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/tokens/{id}

Returns details for the specified shipping token.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 786351

This token's ID.

Responses

200

successful operation

Response Schema: application/json

name	string This token's name.
id	integer <int32> This token's ID.
token	string The token itself.
updatedAt	string Unix timestamp of when this token was last updated.
updatedBy	string Email address of the last user to update this token.
createdAt	string Unix timestamp of when this token was created.
createdBy	string Email address of the user who created this token.
enabled	boolean If this token is enabled, `true`. If it's disabled, `false`.

Request samples

cURL

Copy

curl -L -X GET 'https://api.layerlog.com/v1/log-shipping/tokens/{id}' \ -H 'X-API-TOKEN: <token>' \ -H 'Content-Type: application/json'

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"name": "apac prod",
"id": 786351,
"token": "6bLXmMA6FLibc7ySSqNcCfvbhtqT0rPS",
"updatedAt": 414720000,
"updatedBy": "shalom.the.mighty@gmail.com",
"createdAt": 389836800,
"createdBy": "you.got.this@gmail.com",
"enabled": true
}

Update a log shipping token

put /v1/log-shipping/tokens/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/tokens/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/tokens/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/tokens/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/tokens/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/tokens/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/tokens/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/tokens/{id}

Enables/disables a log shipping token and/or renames it.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 786351

This token's ID.

Request Body schema: application/json

name	string Descriptive name for this token.
enabled	boolean Default: true To enable this token, `true`. To disable, `false`.

Responses

200

successful operation

Response Schema: application/json

name	string This token's name.
id	integer <int32> This token's ID.
token	string The token itself.
updatedAt	string Unix timestamp of when this token was last updated.
updatedBy	string Email address of the last user to update this token.
createdAt	string Unix timestamp of when this token was created.
createdBy	string Email address of the user who created this token.
enabled	boolean If this token is enabled, `true`. If it's disabled, `false`.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"name": "staging eu",
"enabled": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"name": "apac prod",
"id": 786351,
"token": "6bLXmMA6FLibc7ySSqNcCfvbhtqT0rPS",
"updatedAt": 414720000,
"updatedBy": "shalom.the.mighty@gmail.com",
"createdAt": 389836800,
"createdBy": "you.got.this@gmail.com",
"enabled": true
}

Delete a log shipping token

delete /v1/log-shipping/tokens/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/tokens/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/tokens/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/tokens/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/tokens/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/tokens/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/tokens/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/tokens/{id}

Deletes a log shipping token by its ID, while providing relevant information about the token's recent status and activity.

An account must have at least 1 enabled token. You won't be able to disable or delete the last token. Important: Active tokens can be deleted using this call. Confirm that a token is no longer needed before deleting it.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 786351

This token's ID.

Responses

200

successful operation

Response Schema: application/json

name	string This token's name.
id	integer <int32> This token's ID.
token	string The token itself.
updatedAt	string Unix timestamp of when this token was last updated.
updatedBy	string Email address of the last user to update this token.
createdAt	string Unix timestamp of when this token was created.
createdBy	string Email address of the user who created this token.
enabled	boolean If this token is enabled, `true`. If it's disabled, `false`.

Request samples

cURL

Copy

curl -L -X DELETE 'https://api.layerlog.com/v1/log-shipping/tokens/786351' \ -H 'X-API-TOKEN: <token>' \ -H 'Content-Type: application/json'

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"name": "apac prod",
"id": 786351,
"token": "6bLXmMA6FLibc7ySSqNcCfvbhtqT0rPS",
"updatedAt": 414720000,
"updatedBy": "shalom.the.mighty@gmail.com",
"createdAt": 389836800,
"createdBy": "you.got.this@gmail.com",
"enabled": true
}

Get number of available tokens

get /v1/log-shipping/tokens/limits

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/tokens/limits

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/tokens/limits

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/tokens/limits

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/tokens/limits

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/tokens/limits

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/tokens/limits

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/tokens/limits

Returns the number of log shipping tokens currently in use and the number of available tokens that can be enabled. Disabled tokens don't count against the token limit.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

maxAllowedTokens	integer <int32> The number of log shipping tokens this account can have.
numOfEnabledTokens	integer <int32> The number of log shipping tokens currently enabled for this account.

Request samples

cURL

Copy

curl -L -X GET 'https://api.layerlog.com/v1/log-shipping/tokens/limits' \ -H 'X-API-TOKEN: <token>' \ -H 'Content-Type: application/json'

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"maxAllowedTokens": 50,
"numOfEnabledTokens": 27
}

Retrieve log shipping tokens

post /v1/log-shipping/tokens/search

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/tokens/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/tokens/search

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/tokens/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/tokens/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/tokens/search

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/tokens/search

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/tokens/search

Returns the relevant shipping tokens, filtered, sorted and paginated as per the request.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

filter	object (ShippingTokensFilterRequest) Filters your search for token attributes.
sort	Array of objects (ShippingTokensSortRequest) Sorts the results before returning them.
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Responses

200

successful operation

Response Schema: application/json

total	integer <int32>
results	Array of objects (ShippingTokensModel)
pagination	object (Pagination) Default pagination is a page of 25 results. Look for the `total` field in the response for the number of available results overall, and use the pagination function to page through the results.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"filter": 
{"enabled": true
},
"sort": 
[
{"field": "NAME",
"descending": true
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"total": 0,
"results": 
[
{"name": "apac prod",
"id": 786351,
"token": "6bLXmMA6FLibc7ySSqNcCfvbhtqT0rPS",
"updatedAt": 414720000,
"updatedBy": "shalom.the.mighty@gmail.com",
"createdAt": 389836800,
"createdBy": "you.got.this@gmail.com",
"enabled": true
}
],
"pagination": 
{"pageNumber": 2,
"pageSize": 100
}
}

Drop filters

Drop filters provide a solution for filtering out logs before they are indexed in your account to help lower costs and reduce account volume.

Drop filters evaluate logs for exact field:value matches. Any log results that match active drop filters will not be indexed. This means they will not appear in your Kibana account, will not be searchable, trigger alerts, or appear in dashboards.

Archiving is not affected by drop filters. Logs dropped by drop filters will still be archived, if archiving is configured for the account. With archiving configured, you can readily use drop filters to reduce logging bulk and restore the logs in the event that they become relevant.

Retrieve drop filters

post /v1/drop-filters/search

US East (Northern Virginia)

https://api.layerlog.com/v1/drop-filters/search

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/drop-filters/search

Canada (Central)

https://api-ca.layerlog.com/v1/drop-filters/search

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/drop-filters/search

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/drop-filters/search

Europe (London)

https://api-uk.layerlog.com/v1/drop-filters/search

West US 2 (Washington)

https://api-wa.layerlog.com/v1/drop-filters/search

Returns all drop filters configured for the account, both active and inactive.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	string Drop filter ID in the Layerlog database. You can run the `/v1/drop-filters/search` endpoint to retrieve the IDs of all the drop filters in the account.
active	boolean If `true`, the drop filter is active and logs that match the filter are dropped before indexing. If `false`, the drop filter is disabled.
logType	string Filters for the log type.
fieldConditions	Array of objects (FieldCondition) Filters for an exact match of a field:value pair.

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": "f54406c1-b4ad-5969-8542-f6a3e9df5c79",
"active": true,
"logType": "apache",
"fieldConditions": 
[
{"fieldName": "response",
"value": 200
}
]
}
]

Activate a drop filter

post /v1/drop-filters/{id}/activate

US East (Northern Virginia)

https://api.layerlog.com/v1/drop-filters/{id}/activate

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/drop-filters/{id}/activate

Canada (Central)

https://api-ca.layerlog.com/v1/drop-filters/{id}/activate

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/drop-filters/{id}/activate

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/drop-filters/{id}/activate

Europe (London)

https://api-uk.layerlog.com/v1/drop-filters/{id}/activate

West US 2 (Washington)

https://api-wa.layerlog.com/v1/drop-filters/{id}/activate

Activates a drop filter identified by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

string

Example: d0d000ce-e63b-595b-a8f9-25032776cd28

Drop filter ID in the Layerlog database. You can run the /v1/drop-filters/search endpoint to retrieve the IDs of all the drop filters in the account.

Responses

200

successful operation

Response Schema: application/json

id	string Drop filter ID in the Layerlog database. You can run the `/v1/drop-filters/search` endpoint to retrieve the IDs of all the drop filters in the account.
active	boolean If `true`, the drop filter is active and logs that match the filter are dropped before indexing. If `false`, the drop filter is disabled.
logType	string Filters for the log type.
fieldConditions	Array of objects (FieldCondition) Filters for an exact match of a field:value pair.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "f54406c1-b4ad-5969-8542-f6a3e9df5c79",
"active": true,
"logType": "apache",
"fieldConditions": 
[
{"fieldName": "response",
"value": 200
}
]
}

Deactivate a drop filter

post /v1/drop-filters/{id}/deactivate

US East (Northern Virginia)

https://api.layerlog.com/v1/drop-filters/{id}/deactivate

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/drop-filters/{id}/deactivate

Canada (Central)

https://api-ca.layerlog.com/v1/drop-filters/{id}/deactivate

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/drop-filters/{id}/deactivate

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/drop-filters/{id}/deactivate

Europe (London)

https://api-uk.layerlog.com/v1/drop-filters/{id}/deactivate

West US 2 (Washington)

https://api-wa.layerlog.com/v1/drop-filters/{id}/deactivate

Deactivates a drop filter identified by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

string

Example: d0d000ce-e63b-595b-a8f9-25032776cd28

Drop filter ID in the Layerlog database. You can run the /v1/drop-filters/search endpoint to retrieve the IDs of all the drop filters in the account.

Responses

200

successful operation

Response Schema: application/json

id	string Drop filter ID in the Layerlog database. You can run the `/v1/drop-filters/search` endpoint to retrieve the IDs of all the drop filters in the account.
active	boolean If `true`, the drop filter is active and logs that match the filter are dropped before indexing. If `false`, the drop filter is disabled.
logType	string Filters for the log type.
fieldConditions	Array of objects (FieldCondition) Filters for an exact match of a field:value pair.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "f54406c1-b4ad-5969-8542-f6a3e9df5c79",
"active": true,
"logType": "apache",
"fieldConditions": 
[
{"fieldName": "response",
"value": 200
}
]
}

Delete a drop filter

delete /v1/drop-filters/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/drop-filters/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/drop-filters/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/drop-filters/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/drop-filters/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/drop-filters/{id}

Europe (London)

https://api-uk.layerlog.com/v1/drop-filters/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/drop-filters/{id}

Deletes a drop filter identified by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

string

Example: d0d000ce-e63b-595b-a8f9-25032776cd28

Drop filter ID in the Layerlog database. You can run the /v1/drop-filters/search endpoint to retrieve the IDs of all the drop filters in the account.

Responses

200

successful operation

Response Schema: application/json

id	string Drop filter ID in the Layerlog database. You can run the `/v1/drop-filters/search` endpoint to retrieve the IDs of all the drop filters in the account.
active	boolean If `true`, the drop filter is active and logs that match the filter are dropped before indexing. If `false`, the drop filter is disabled.
logType	string Filters for the log type.
fieldConditions	Array of objects (FieldCondition) Filters for an exact match of a field:value pair.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "f54406c1-b4ad-5969-8542-f6a3e9df5c79",
"active": true,
"logType": "apache",
"fieldConditions": 
[
{"fieldName": "response",
"value": 200
}
]
}

Create drop filter

post /v1/drop-filters

US East (Northern Virginia)

https://api.layerlog.com/v1/drop-filters

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/drop-filters

Canada (Central)

https://api-ca.layerlog.com/v1/drop-filters

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/drop-filters

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/drop-filters

Europe (London)

https://api-uk.layerlog.com/v1/drop-filters

West US 2 (Washington)

https://api-wa.layerlog.com/v1/drop-filters

Creates and activates a new drop filter.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

logType	string Nullable Filters for the log type.
fieldConditions	Array of objects (FieldCondition)

Responses

200

successful operation

Response Schema: application/json

id	string Drop filter ID in the Layerlog database. You can run the `/v1/drop-filters/search` endpoint to retrieve the IDs of all the drop filters in the account.
active	boolean If `true`, the drop filter is active and logs that match the filter are dropped before indexing. If `false`, the drop filter is disabled.
logType	string Filters for the log type.
fieldConditions	Array of objects (FieldCondition) Filters for an exact match of a field:value pair.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"logType": "apache",
"fieldConditions": 
[
{"fieldName": "response",
"value": 200
}
]
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": "f54406c1-b4ad-5969-8542-f6a3e9df5c79",
"active": true,
"logType": "apache",
"fieldConditions": 
[
{"fieldName": "response",
"value": 200
}
]
}

Archive logs

You can archive logs to an AWS S3 bucket or Azure Blob Storage. Archiving gives you the option to restore logs and query them after they have expired from your time-based account.

You can use the following endpoints to retrieve, set up, test, and update an account's archive settings.

Note: Logs are archived before they are indexed and analyzed by Layerlog. If you are using drop filters, note that dropped logs will still be archived.

Retrieve archiving settings

get /v2/archive/settings

US East (Northern Virginia)

https://api.layerlog.com/v2/archive/settings

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/archive/settings

Canada (Central)

https://api-ca.layerlog.com/v2/archive/settings

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/archive/settings

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/archive/settings

Europe (London)

https://api-uk.layerlog.com/v2/archive/settings

West US 2 (Washington)

https://api-wa.layerlog.com/v2/archive/settings

Gets the current archive settings for a time-based log account.

Note that only one archive can be active per account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Unique ID of the archive settings.
settings	object (ArchiveSettings)

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 323,
"settings": 
{"storageType": "S3",
"enabled": true,
"compressed": true,
"amazonS3StorageSettings": 
{"credentialsType": "IAM",
"path": "string",
"s3SecretCredentials": 
{"accessKey": "string",
"secretKey": "string"
},
"s3IamCredentials": 
{"arn": "string"
}
},
"azureBlobStorageSettings": 
{"tenantId": "string",
"clientId": "string",
"clientSecret": "string",
"accountName": "string",
"containerName": "string",
"path": "string"
}
}
}

Set up archiving

post /v2/archive/settings

US East (Northern Virginia)

https://api.layerlog.com/v2/archive/settings

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/archive/settings

Canada (Central)

https://api-ca.layerlog.com/v2/archive/settings

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/archive/settings

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/archive/settings

Europe (London)

https://api-uk.layerlog.com/v2/archive/settings

West US 2 (Washington)

https://api-wa.layerlog.com/v2/archive/settings

Configure archiving for a time-based log account. One archive can be configured per account (or sub account). For more on this, see AWS Access with IAM and Archiving.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

storageType required	string Enum: "S3" "BLOB" Specifies the storage provider. If `S3`, the `amazonS3StorageSettings` are relevant. If `BLOB`, the `azureBlobStorageSettings` are relevant.
enabled	boolean Default: true If `true`, archiving is currently enabled.
compressed	boolean Default: true If `true`, logs are compressed before they are archived.
amazonS3StorageSettings	object (S3StorageSettings) Applicable settings when the `storageType` is `S3`.
azureBlobStorageSettings	object (BlobSettings) Applicable settings when the `storageType` is `Blob`. For detailed instructions about setting up a storage container in Azure and locating the required parameters, click here.

Responses

default

successful operation

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"storageType": "S3",
"enabled": true,
"compressed": true,
"amazonS3StorageSettings": 
{"credentialsType": "IAM",
"path": "string",
"s3SecretCredentials": 
{"accessKey": "string",
"secretKey": "string"
},
"s3IamCredentials": 
{"arn": "string"
}
},
"azureBlobStorageSettings": 
{"tenantId": "string",
"clientId": "string",
"clientSecret": "string",
"accountName": "string",
"containerName": "string",
"path": "string"
}
}

Test archive settings

post /v2/archive/settings/test

US East (Northern Virginia)

https://api.layerlog.com/v2/archive/settings/test

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/archive/settings/test

Canada (Central)

https://api-ca.layerlog.com/v2/archive/settings/test

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/archive/settings/test

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/archive/settings/test

Europe (London)

https://api-uk.layerlog.com/v2/archive/settings/test

West US 2 (Washington)

https://api-wa.layerlog.com/v2/archive/settings/test

Tests the settings and returns the status code to confirm that a connection with the provider was established.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

Responses

default

successful operation

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all

{ }

Retrieve archive settings

get /v2/archive/settings/{id}

US East (Northern Virginia)

https://api.layerlog.com/v2/archive/settings/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/archive/settings/{id}

Canada (Central)

https://api-ca.layerlog.com/v2/archive/settings/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/archive/settings/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/archive/settings/{id}

Europe (London)

https://api-uk.layerlog.com/v2/archive/settings/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/archive/settings/{id}

Retrieves an archiving settings by the ID of the settings.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Example: 33

ID of the archive settings.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Unique ID of the archive settings.
settings	object (ArchiveSettings)

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 323,
"settings": 
{"storageType": "S3",
"enabled": true,
"compressed": true,
"amazonS3StorageSettings": 
{"credentialsType": "IAM",
"path": "string",
"s3SecretCredentials": 
{"accessKey": "string",
"secretKey": "string"
},
"s3IamCredentials": 
{"arn": "string"
}
},
"azureBlobStorageSettings": 
{"tenantId": "string",
"clientId": "string",
"clientSecret": "string",
"accountName": "string",
"containerName": "string",
"path": "string"
}
}
}

Update archive settings

put /v2/archive/settings/{id}

US East (Northern Virginia)

https://api.layerlog.com/v2/archive/settings/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/archive/settings/{id}

Canada (Central)

https://api-ca.layerlog.com/v2/archive/settings/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/archive/settings/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/archive/settings/{id}

Europe (London)

https://api-uk.layerlog.com/v2/archive/settings/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/archive/settings/{id}

Updates the archiving settings for a time-based log account. (The API token identifies the account.)

You can use this endpoint to:

Switch archive settings between AWS and Azure Blob Storage or vice versa.
Update credentials.
Switch your AWS authentication method between credential keys and IAM roles.

Note that only one archive can be active per account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the archive settings.

Request Body schema: application/json

storageType required	string Enum: "S3" "BLOB" Specifies the storage provider. If `S3`, the `amazonS3StorageSettings` are relevant. If `BLOB`, the `azureBlobStorageSettings` are relevant.
enabled	boolean Default: true If `true`, archiving is currently enabled.
compressed	boolean Default: true If `true`, logs are compressed before they are archived.
amazonS3StorageSettings	object (S3StorageSettings) Applicable settings when the `storageType` is `S3`.
azureBlobStorageSettings	object (BlobSettings) Applicable settings when the `storageType` is `Blob`. For detailed instructions about setting up a storage container in Azure and locating the required parameters, click here.

Responses

default

successful operation

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"storageType": "S3",
"enabled": true,
"compressed": true,
"amazonS3StorageSettings": 
{"credentialsType": "IAM",
"path": "string",
"s3SecretCredentials": 
{"accessKey": "string",
"secretKey": "string"
},
"s3IamCredentials": 
{"arn": "string"
}
},
"azureBlobStorageSettings": 
{"tenantId": "string",
"clientId": "string",
"clientSecret": "string",
"accountName": "string",
"containerName": "string",
"path": "string"
}
}

Delete archive settings

delete /v2/archive/settings/{id}

US East (Northern Virginia)

https://api.layerlog.com/v2/archive/settings/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v2/archive/settings/{id}

Canada (Central)

https://api-ca.layerlog.com/v2/archive/settings/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v2/archive/settings/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v2/archive/settings/{id}

Europe (London)

https://api-uk.layerlog.com/v2/archive/settings/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v2/archive/settings/{id}

Deletes the archiving settings for a time-based log account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the archive settings.

Responses

default

successful operation

Restore logs

You can restore data from your active archiving account, whether an AWS S3 bucket or Azure Blob Storage. Restoring data gives you the option to query logs after they have expired from your time-based account.

You can use the following endpoints to initiate a new restore process, retrieve, set up, test, and update an account's archive settings.

Note: Logs that are dropped by drop filters are still archived and can be restored. You can temporarily disable drop filters to restore the data.

Retrieve all restore operations

get /archive/restore

US East (Northern Virginia)

https://api.layerlog.com/archive/restore

Asia Pacific (Sydney)

https://api-au.layerlog.com/archive/restore

Canada (Central)

https://api-ca.layerlog.com/archive/restore

Europe (Frankfurt)

https://api-eu.layerlog.com/archive/restore

West Europe (Netherlands)

https://api-nl.layerlog.com/archive/restore

Europe (London)

https://api-uk.layerlog.com/archive/restore

West US 2 (Washington)

https://api-wa.layerlog.com/archive/restore

Returns a complete history of all restore operations initiated for the account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> ID of the restore operation in Layerlog
accountId	integer <int32> ID of the restored account in Layerlog
accountName	string Name of the restored account
restoredVolumeGb	number <float> Nullable Volume of data restored so far. If the restore operation is still in progress, this will be continuously updated.
status	string Enum: "IN_PROGRESS" "ACTIVE" "LIMIT_EXCEEDED" "ABORTED" "FAILED" "DELETED" "EXPIRED" Returns the current status of the restored account. IN_PROGRESS - Data is being restored and is not yet available for querying or searching in Kibana. ACTIVE - The restored account is active and available for searching and querying in Kibana. Be sure to search the data in its original timestamp. LIMIT_EXCEEDED - The data exceeded 100 GB and caused the restore action to fail. ABORTED - A user aborted the restore operation before it completed. Only one account can be restored at a time. FAILED - The restored account failed to restore the data. DELETED - The restored account was deleted by a user. EXPIRED - Restored accounts automatically expire after a number of days, as indicated by `expiresAt`.
startTime	integer <int64> UNIX timestamp in milliseconds specifying the earliest logs to be restored.
endTime	integer <int64> UNIX timestamp in milliseconds specifying the latest logs to be restored.
createdAt	integer <int64> Timestamp when the restore process was created and entered the queue. (Since only one account can be restored at a time, the process may not initiate immediately.)
startedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process initiated.
finishedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process completed.
expiresAt	integer <int64> Nullable UNIX timestamp in milliseconds specifying when the account is due to expire. Restored accounts expire automatically after a number of days, as specified in the account's terms.

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 42,
"accountId": 564321,
"accountName": "My account name",
"restoredVolumeGb": 99,
"status": "ACTIVE",
"startTime": 1589947200,
"endTime": 1589954400,
"createdAt": 1591902426,
"startedAt": 1591902428,
"finishedAt": 1591902461,
"expiresAt": 1592334461
}
]

Initiate restore operation

post /archive/restore

US East (Northern Virginia)

https://api.layerlog.com/archive/restore

Asia Pacific (Sydney)

https://api-au.layerlog.com/archive/restore

Canada (Central)

https://api-ca.layerlog.com/archive/restore

Europe (Frankfurt)

https://api-eu.layerlog.com/archive/restore

West Europe (Netherlands)

https://api-nl.layerlog.com/archive/restore

Europe (London)

https://api-uk.layerlog.com/archive/restore

West US 2 (Washington)

https://api-wa.layerlog.com/archive/restore

Initiates a new operation to restore data from a specific time frame. (As a result, also triggers the creation of a temporary restored account in Layerlog to hold the restored data until its automatic expiration.)

Authorizations:

X-API-TOKEN

Request Body schema: application/json

accountName	string Name of the restored account
startTime	integer <int64> UNIX timestamp in milliseconds specifying the earliest logs to be restored.
endTime	integer <int64> UNIX timestamp in milliseconds specifying the latest logs to be restored.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the restore operation in Layerlog
accountId	integer <int32> ID of the restored account in Layerlog
accountName	string Name of the restored account
restoredVolumeGb	number <float> Nullable Volume of data restored so far. If the restore operation is still in progress, this will be continuously updated.
status	string Enum: "IN_PROGRESS" "ACTIVE" "LIMIT_EXCEEDED" "ABORTED" "FAILED" "DELETED" "EXPIRED" Returns the current status of the restored account. IN_PROGRESS - Data is being restored and is not yet available for querying or searching in Kibana. ACTIVE - The restored account is active and available for searching and querying in Kibana. Be sure to search the data in its original timestamp. LIMIT_EXCEEDED - The data exceeded 100 GB and caused the restore action to fail. ABORTED - A user aborted the restore operation before it completed. Only one account can be restored at a time. FAILED - The restored account failed to restore the data. DELETED - The restored account was deleted by a user. EXPIRED - Restored accounts automatically expire after a number of days, as indicated by `expiresAt`.
startTime	integer <int64> UNIX timestamp in milliseconds specifying the earliest logs to be restored.
endTime	integer <int64> UNIX timestamp in milliseconds specifying the latest logs to be restored.
createdAt	integer <int64> Timestamp when the restore process was created and entered the queue. (Since only one account can be restored at a time, the process may not initiate immediately.)
startedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process initiated.
finishedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process completed.
expiresAt	integer <int64> Nullable UNIX timestamp in milliseconds specifying when the account is due to expire. Restored accounts expire automatically after a number of days, as specified in the account's terms.

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"accountName": "My account name",
"startTime": 1589947200,
"endTime": 1589954400
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 42,
"accountId": 564321,
"accountName": "My account name",
"restoredVolumeGb": 99,
"status": "ACTIVE",
"startTime": 1589947200,
"endTime": 1589954400,
"createdAt": 1591902426,
"startedAt": 1591902428,
"finishedAt": 1591902461,
"expiresAt": 1592334461
}

Get an update on a restore operation

get /archive/restore/{id}

US East (Northern Virginia)

https://api.layerlog.com/archive/restore/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/archive/restore/{id}

Canada (Central)

https://api-ca.layerlog.com/archive/restore/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/archive/restore/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/archive/restore/{id}

Europe (London)

https://api-uk.layerlog.com/archive/restore/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/archive/restore/{id}

Returns the status of a specific restore operation by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the restore process

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the restore operation in Layerlog
accountId	integer <int32> ID of the restored account in Layerlog
accountName	string Name of the restored account
restoredVolumeGb	number <float> Nullable Volume of data restored so far. If the restore operation is still in progress, this will be continuously updated.
status	string Enum: "IN_PROGRESS" "ACTIVE" "LIMIT_EXCEEDED" "ABORTED" "FAILED" "DELETED" "EXPIRED" Returns the current status of the restored account. IN_PROGRESS - Data is being restored and is not yet available for querying or searching in Kibana. ACTIVE - The restored account is active and available for searching and querying in Kibana. Be sure to search the data in its original timestamp. LIMIT_EXCEEDED - The data exceeded 100 GB and caused the restore action to fail. ABORTED - A user aborted the restore operation before it completed. Only one account can be restored at a time. FAILED - The restored account failed to restore the data. DELETED - The restored account was deleted by a user. EXPIRED - Restored accounts automatically expire after a number of days, as indicated by `expiresAt`.
startTime	integer <int64> UNIX timestamp in milliseconds specifying the earliest logs to be restored.
endTime	integer <int64> UNIX timestamp in milliseconds specifying the latest logs to be restored.
createdAt	integer <int64> Timestamp when the restore process was created and entered the queue. (Since only one account can be restored at a time, the process may not initiate immediately.)
startedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process initiated.
finishedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process completed.
expiresAt	integer <int64> Nullable UNIX timestamp in milliseconds specifying when the account is due to expire. Restored accounts expire automatically after a number of days, as specified in the account's terms.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 42,
"accountId": 564321,
"accountName": "My account name",
"restoredVolumeGb": 99,
"status": "ACTIVE",
"startTime": 1589947200,
"endTime": 1589954400,
"createdAt": 1591902426,
"startedAt": 1591902428,
"finishedAt": 1591902461,
"expiresAt": 1592334461
}

Delete a restore operation

delete /archive/restore/{id}

US East (Northern Virginia)

https://api.layerlog.com/archive/restore/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/archive/restore/{id}

Canada (Central)

https://api-ca.layerlog.com/archive/restore/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/archive/restore/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/archive/restore/{id}

Europe (London)

https://api-uk.layerlog.com/archive/restore/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/archive/restore/{id}

Aborts a restore process before its completion.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

ID of the restore process.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> ID of the restore operation in Layerlog
accountId	integer <int32> ID of the restored account in Layerlog
accountName	string Name of the restored account
restoredVolumeGb	number <float> Nullable Volume of data restored so far. If the restore operation is still in progress, this will be continuously updated.
status	string Enum: "IN_PROGRESS" "ACTIVE" "LIMIT_EXCEEDED" "ABORTED" "FAILED" "DELETED" "EXPIRED" Returns the current status of the restored account. IN_PROGRESS - Data is being restored and is not yet available for querying or searching in Kibana. ACTIVE - The restored account is active and available for searching and querying in Kibana. Be sure to search the data in its original timestamp. LIMIT_EXCEEDED - The data exceeded 100 GB and caused the restore action to fail. ABORTED - A user aborted the restore operation before it completed. Only one account can be restored at a time. FAILED - The restored account failed to restore the data. DELETED - The restored account was deleted by a user. EXPIRED - Restored accounts automatically expire after a number of days, as indicated by `expiresAt`.
startTime	integer <int64> UNIX timestamp in milliseconds specifying the earliest logs to be restored.
endTime	integer <int64> UNIX timestamp in milliseconds specifying the latest logs to be restored.
createdAt	integer <int64> Timestamp when the restore process was created and entered the queue. (Since only one account can be restored at a time, the process may not initiate immediately.)
startedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process initiated.
finishedAt	integer <int64> Nullable UNIX timestamp in milliseconds when the restore process completed.
expiresAt	integer <int64> Nullable UNIX timestamp in milliseconds specifying when the account is due to expire. Restored accounts expire automatically after a number of days, as specified in the account's terms.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 42,
"accountId": 564321,
"accountName": "My account name",
"restoredVolumeGb": 99,
"status": "ACTIVE",
"startTime": 1589947200,
"endTime": 1589954400,
"createdAt": 1591902426,
"startedAt": 1591902428,
"finishedAt": 1591902461,
"expiresAt": 1592334461
}

Parsing

Parse sample logs with a Sawmill pipeline

post /v1/sawmill/log-type-pipeline/logType

US East (Northern Virginia)

https://api.layerlog.com/v1/sawmill/log-type-pipeline/logType

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/sawmill/log-type-pipeline/logType

Canada (Central)

https://api-ca.layerlog.com/v1/sawmill/log-type-pipeline/logType

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/sawmill/log-type-pipeline/logType

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/sawmill/log-type-pipeline/logType

Europe (London)

https://api-uk.layerlog.com/v1/sawmill/log-type-pipeline/logType

West US 2 (Washington)

https://api-wa.layerlog.com/v1/sawmill/log-type-pipeline/logType

Performs parsing of sample logs with a given Sawmill pipeline (https://github.com/logzio/sawmill/wiki). A pipeline is a collection of parsing rules to be executed in a specific order where the syntax and functionality follow the guidelines of the Sawmill library. Note: this endpoint is not used to create or update parsing, but for testing purposes only,

Authorizations:

X-API-TOKEN

path Parameters

logType

required

string

Example: TestType

Type of the log being parsed. This can be an existing type (already sent to Layerlog) or a new type (to be sent to Layerlog for parsing).

Request Body schema: application/json

pipeLineDefinition	object JSON object of a Sawmill pipeline. Defines what transaformations should be applied to the input. In the example shown, an extra field `Movie` with the value `TheMatrix` will be added to the input. Always make sure that items in the input object representing the sawmill pipeline, are escaped.
sampleLogs	Array of objects A list of JSON objects. If the log is available only as a plain string, this string needs to be in the `message` field of the JSON object.

Responses

200

Response Schema: application/json

Array

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"pipeLineDefinition": "{\"steps\":[{\"addField\":{\"name\":\"addField\",\"config\":{\"path\":\"Movie\",\"value\":\"TheMatrix\"}}}]}",
"sampleLogs": 
[
{"fragment": "test",
"UA-device": "Other",
"check": "value",
"message": "balima",
"type"": "TestType"
}
]
}

Response samples

Content type

application/json

Copy

Expand all Collapse all

"{\"Movie\":\"TheMatrix\",\"fragment\":\"test\",\"@timestamp\":\"2021-08-15T12:17:45.731+0000\",\"check\":\"value\",\"message\":\"balima\",\"type\":\"TestType\",\"UA-device\":\"Other\"}"

Get pipeline definition for a log type

get /v1/sawmill/log-type-pipeline/logType

US East (Northern Virginia)

https://api.layerlog.com/v1/sawmill/log-type-pipeline/logType

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/sawmill/log-type-pipeline/logType

Canada (Central)

https://api-ca.layerlog.com/v1/sawmill/log-type-pipeline/logType

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/sawmill/log-type-pipeline/logType

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/sawmill/log-type-pipeline/logType

Europe (London)

https://api-uk.layerlog.com/v1/sawmill/log-type-pipeline/logType

West US 2 (Washington)

https://api-wa.layerlog.com/v1/sawmill/log-type-pipeline/logType

Receive pipeline definition for a given log type, if the definition is already stored.

Authorizations:

X-API-TOKEN

path Parameters

logType

required

string

Log type that you need to retrieve a Sawmill pipeline for. If no parsing has been applied to this log type, 404 error will be given.

Responses

200

successful operation

Response Schema: application/json

404

pipeline not found for this log type

Response Schema: application/json

Response samples

Content type

application/json

Copy

Expand all Collapse all

"{\"steps\":[{\"addField\":{\"name\":\"addField\",\"config\":{\"path\":\"Movie\",\"value\":\"TheMatrix\"}}}]}"

Upload an external mapping file to Layerlog storage.

post /v1/sawmill/external-mapping/upload

US East (Northern Virginia)

https://api.layerlog.com/v1/sawmill/external-mapping/upload

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/sawmill/external-mapping/upload

Canada (Central)

https://api-ca.layerlog.com/v1/sawmill/external-mapping/upload

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/sawmill/external-mapping/upload

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/sawmill/external-mapping/upload

Europe (London)

https://api-uk.layerlog.com/v1/sawmill/external-mapping/upload

West US 2 (Washington)

https://api-wa.layerlog.com/v1/sawmill/external-mapping/upload

Uploads an external mapping file in .properties format to Layerlog storage. This file can be used later by Sawmill ExternalMappingSourceProcessor. This feature is not available by default. To enable it, contact Layerlog support. 10 files can be uploaded per account. The file size is limited to 50 MB.

Authorizations:

X-API-TOKEN

Request Body schema: multipart/form-data

file	Array of strings <binary>

Responses

201

successful operation

Response Schema: application/json

result

string

Successfully updated external mapping

400

bad request

Response Schema: application/json

errorCode	string
message	string
requestId	string
parameters	object

422

validation error

Response Schema: application/json

result

string

Failed to update external mapping

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"result": "Successfully updated external mapping"
}

Get all log types

get /v1/account/log-types

US East (Northern Virginia)

https://api.layerlog.com/v1/account/log-types

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/account/log-types

Canada (Central)

https://api-ca.layerlog.com/v1/account/log-types

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/account/log-types

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/account/log-types

Europe (London)

https://api-uk.layerlog.com/v1/account/log-types

West US 2 (Washington)

https://api-wa.layerlog.com/v1/account/log-types

Get all log types for a given account including the log types with no parsing attached.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

string

Response samples

Content type

application/json

Copy

Expand all Collapse all


["“metering-access”",
"“lag-monitor”",
"“business-analytics-metrics”",
"“consul-agent”",
"“auth0”"
]

Retrieve audit trail

Retrieve all event types in the audit trail

post /v1/audit-trail/event-types

US East (Northern Virginia)

https://api.layerlog.com/v1/audit-trail/event-types

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/audit-trail/event-types

Canada (Central)

https://api-ca.layerlog.com/v1/audit-trail/event-types

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/audit-trail/event-types

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/audit-trail/event-types

Europe (London)

https://api-uk.layerlog.com/v1/audit-trail/event-types

West US 2 (Washington)

https://api-wa.layerlog.com/v1/audit-trail/event-types

Returns an array of strings. Each string is an event type that appears in the account's audit trail. Each event type is shown once, no matter how many times it occurs in the account's audit trail.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

eventTypes

Array of strings

Event types in the audit trail

Request samples

cURL

Copy

curl -X POST "https://api.layerlog.com/v1/audit-trail/event-types" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"eventTypes": 
["Added user",
"Admin created a sub account",
"Changed password",
"Failed login",
"Login",
"Layerlog admin has enabled a sawmill configuration",
"Suspended user",
"User created a token",
"User installed an ELK app"
]
}

Retrieve a filtered list of audit trail events

post /v1/audit-trail

US East (Northern Virginia)

https://api.layerlog.com/v1/audit-trail

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/audit-trail

Canada (Central)

https://api-ca.layerlog.com/v1/audit-trail

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/audit-trail

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/audit-trail

Europe (London)

https://api-uk.layerlog.com/v1/audit-trail

West US 2 (Washington)

https://api-wa.layerlog.com/v1/audit-trail

Authorizations:

X-API-TOKEN

Request Body schema: application/json

size	integer <int32> [ 0 .. 500 ] Default: 500 Maximum number of results to return.
from	integer <int32> [ 0 .. 2147483647 ] Default: 0 Of the results found, the first result to return.
auditEventUser	object (AuditEventUser)
auditEventType	string Code for the event type
fromDate	integer <int64> Starting timedate, as Unix epoch milliseconds.
toDate	integer <int64> Ending timedate, as Unix epoch milliseconds.
sortDescending	boolean To sort results in descending order, `true`. For ascending order, `false`.
includeFiltersData	boolean

Responses

200

successful operation

Response Schema: application/json

pageSize	integer <int32> [ 0 .. 500 ] The number of results requested
from	integer <int32> [ 0 .. 2147483647 ] Of the results found, the first result returned.
total	integer <int64> [ 0 .. 500 ] Total number of results that met the search criteria.
results	Array of objects (AuditEventData)
auditEventUsersList	Array of objects (AuditEventUser)
auditEventTypesList	Array of objects (AuditEventTypeData)

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"size": 150,
"from": 15,
"auditEventUser": 
{"id": 5374,
"fullName": "Larry Appleton",
"deleted": false,
"userToken": true
},
"auditEventType": "Added user",
"fromDate": 389880000,
"toDate": 414763200,
"sortDescending": true,
"includeFiltersData": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"pageSize": 50,
"from": 0,
"total": 0,
"results": 
[
{"auditEventUser": 
{"id": 5374,
"fullName": "Larry Appleton",
"deleted": false,
"userToken": true
},
"date": 1527168668,
"auditEventTypeTitle": "Admin created a sub account",
"ip": "52.203.237.249",
"geoLocation": "New York - USA",
"extraDataList": 
[
{"fieldName": "Account name",
"oldValue": "Test account",
"newValue": "Apache access logs"
}
],
"valid": true
}
],
"auditEventUsersList": 
[
{"id": 5374,
"fullName": "Larry Appleton",
"deleted": false,
"userToken": true
}
],
"auditEventTypesList": 
[
{"auditEventType": "Added user",
"auditEventTypeTitle": "Added user"
}
]
}

Connect to CloudTrail

Establish a connection to ship logs to the Layerlog observability platform via an S3 bucket. Supports CloudTrail logs.

Retrieve all connected CloudTrail resources

get /v1/log-shipping/cloudtrails

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/cloudtrails

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/cloudtrails

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/cloudtrails

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/cloudtrails

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/cloudtrails

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/cloudtrails

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/cloudtrails

Returns a list of CloudTrail resources connected to your Layerlog account.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

id	integer <int32> Layerlog ID of the CloudTrail connector. Use this ID to perform operations on the connector using Layerlog API endpoints.
accessKey	string AWS S3 access key
bucket	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean If `true`, the CloudTrail connector is active and logs are being shipped to Layerlog. If `false`, the connector is disabled.

Request samples

cURL

Copy

curl -X GET "https://api.layerlog.com/v1/log-shipping/cloudtrails" -H "accept: application/json" -H "content-type: application/json" -H "X-API-TOKEN: <token>"

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"id": 15,
"accessKey": "ee07df5801500745419c6dff",
"bucket": "cloudtrails bucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true
}
]

Create a new CloudTrail connector

post /v1/log-shipping/cloudtrails

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/cloudtrails

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/cloudtrails

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/cloudtrails

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/cloudtrails

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/cloudtrails

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/cloudtrails

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/cloudtrails

Establishes a new connection to a CloudTrail resource. As a result, logs from your CloudTrail resource will ship to the connected Layerlog account via an AWS S3 bucket.

CloudTrail logs will be parsed using the Layerlog custom CloudTrail parsing pipeline.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

accessKey	string AWS S3 access key
secretKey	string AWS secret access key
bucket	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean If `true`, the CloudTrail connector is active and logs are being shipped to Layerlog. If `false`, the connector is disabled.

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> >= 1 Layerlog ID of the CloudTrail connector. Use this ID to perform operations on the connector using Layerlog API endpoints.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"accessKey": "ee07df5801500745419c6dff",
"secretKey": "506d891fe2163a511b450eddc3279539f6",
"bucket": "LogzioBucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1
}

Retrieve CloudTrail connector by ID

get /v1/log-shipping/cloudtrails/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/cloudtrails/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/cloudtrails/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/cloudtrails/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/cloudtrails/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/cloudtrails/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/cloudtrails/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/cloudtrails/{id}

Returns details for a CloudTrail connector, identified by its ID.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Layerlog ID of the CloudTrail connector

Responses

200

successful operation

Response Schema: application/json

id	integer <int32> Layerlog ID of the CloudTrail connector. Use this ID to perform operations on the connector using Layerlog API endpoints.
accessKey	string AWS S3 access key
bucket	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean If `true`, the CloudTrail connector is active and logs are being shipped to Layerlog. If `false`, the connector is disabled.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 15,
"accessKey": "ee07df5801500745419c6dff",
"bucket": "cloudtrails bucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true
}

Update a CloudTrail connector

put /v1/log-shipping/cloudtrails/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/cloudtrails/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/cloudtrails/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/cloudtrails/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/cloudtrails/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/cloudtrails/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/cloudtrails/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/cloudtrails/{id}

Updates details for a CloudTrail connector.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Layerlog ID of the CloudTrail connector.

Request Body schema: application/json

accessKey	string AWS S3 access key
secretKey	string AWS secret access key
bucket	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean If `true`, the CloudTrail connector is active and logs are being shipped to Layerlog. If `false`, the connector is disabled.

Responses

200

successful operation

Response Schema: application/json

message

string

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"accessKey": "ee07df5801500745419c6dff",
"secretKey": "506d891fe2163a511b450eddc3279539f6",
"bucket": "LogzioBucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "string"
}

Delete a CloudTrail connector

delete /v1/log-shipping/cloudtrails/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/cloudtrails/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/cloudtrails/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/cloudtrails/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/cloudtrails/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/cloudtrails/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/cloudtrails/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/cloudtrails/{id}

Deletes a CloudTrail connector. As a result, CloudTrail will stop shipping data to your Layerlog account.

Note: This endpoint requires permissions that must be set by our Support team. Please email destek@layerlog.com for assistance.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Layerlog ID of the CloudTrail connector.

Responses

200

successful operation

Response Schema: application/json

message

string

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "string"
}

Connect to S3 Buckets

Establish a connection for the Layerlog fetcher to fetch logs to the Layerlog observability platform via an S3 bucket. Supports ELB, S3 Access, CloudFront, VPC Flow logs.

If you're looking to fetch CloudTrail logs, use the designated endpoints.

Authentication can be established with either S3 secret credentials or ARNs (for AWS IAM Roles). Authentication with S3 Secret Credentials is supported for backward compatibility. Authentication with ARNs (for IAM Roles) is strongly recommended.

Retrieve all connected S3 buckets

get /v1/log-shipping/s3-buckets

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/s3-buckets

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/s3-buckets

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/s3-buckets

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/s3-buckets

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/s3-buckets

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/s3-buckets

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/s3-buckets

Returns a list of all S3 buckets connected to your Layerlog account.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

Array

accessKey	string AWS S3 bucket access key
secretKey	string AWS S3 bucket secret key
arn	string Amazon Resource Name (ARN) to uniquely identify the S3 bucket. To generate a new ARN, create a new IAM Role in your AWS admin console.
bucket required	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean Default: true If `true`, the S3 bucket connector is active and logs are being fetched to Layerlog. If `false`, the connector is disabled.
addS3ObjectKeyAsLogField	boolean Default: false If `true`, enriches logs with a new field detailing the S3 object key.
region required	string Enum: "US_EAST_1" "US_EAST_2" "US_WEST_1" "US_WEST_2" "EU_WEST_1" "EU_WEST_2" "EU_WEST_3" "EU_CENTRAL_1" "AP_NORTHEAST_1" "AP_NORTHEAST_2" "AP_SOUTHEAST_1" "AP_SOUTHEAST_2" "SA_EAST_1" "AP_SOUTH_1" "CA_CENTRAL_1" Specify one supported AWS region.
logsType required	string Enum: "elb" "vpcflow" "S3Access" "cloudfront" Specifies the log type being sent to Layerlog. Determines the parsing pipeline used to parse and map the logs. Learn more about parsing options supported by Layerlog.

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"accessKey": "ee07df5801500745419c6dff",
"secretKey": "506d891fe2163a511b450eddc3279539f6",
"arn": "string",
"bucket": "AWS bucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true,
"addS3ObjectKeyAsLogField": true,
"region": "US_EAST_1",
"logsType": "elb"
}
]

Create a new S3 bucket connector

post /v1/log-shipping/s3-buckets

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/s3-buckets

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/s3-buckets

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/s3-buckets

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/s3-buckets

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/s3-buckets

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/s3-buckets

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/s3-buckets

Establishes a new connection of the Layerlog fetcher to an AWS S3 bucket. As a result, logs from your AWS resource will begin shipping to the connected Layerlog account via an AWS S3 bucket.

Logs will be parsed using the Layerlog custom parsing pipeline for the resource.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

accessKey	string AWS S3 bucket access key
secretKey	string AWS S3 bucket secret key
arn	string Amazon Resource Name (ARN) to uniquely identify the S3 bucket. To generate a new ARN, create a new IAM Role in your AWS admin console.
bucket required	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean Default: true If `true`, the S3 bucket connector is active and logs are being shipped to Layerlog. If `false`, the connector is disabled.
addS3ObjectKeyAsLogField	boolean Default: false If `true`, enriches logs with a new field detailing the S3 object key.
region required	string Enum: "US_EAST_1" "US_EAST_2" "US_WEST_1" "US_WEST_2" "EU_WEST_1" "EU_WEST_2" "EU_WEST_3" "EU_CENTRAL_1" "AP_NORTHEAST_1" "AP_NORTHEAST_2" "AP_SOUTHEAST_1" "AP_SOUTHEAST_2" "SA_EAST_1" "AP_SOUTH_1" "CA_CENTRAL_1" Specify one supported AWS region.
logsType required	string Enum: "elb" "vpcflow" "S3Access" "cloudfront" Specify the log type you will be sending to Layerlog. As a result, Layerlog will apply the appropriate parsing pipeline. Learn more about parsing options supported by Layerlog.

Responses

default

successful operation

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"accessKey": "ee07df5801500745419c6dff",
"secretKey": "506d891fe2163a511b450eddc3279539f6",
"arn": "string",
"bucket": "AWS bucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true,
"addS3ObjectKeyAsLogField": true,
"region": "US_EAST_1",
"logsType": "elb"
}

Retrieve an S3 bucket connector by ID

get /v1/log-shipping/s3-buckets/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/s3-buckets/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/s3-buckets/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/s3-buckets/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/s3-buckets/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/s3-buckets/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/s3-buckets/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/s3-buckets/{id}

Returns connection details for an S3 bucket connector by its ID.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Layerlog ID of the S3 Bucket connector. You can run the relevant GET endpoints to retrieve the ID.

Responses

200

successful operation

Response Schema: application/json

accessKey	string AWS S3 bucket access key
secretKey	string AWS S3 bucket secret key
arn	string Amazon Resource Name (ARN) to uniquely identify the S3 bucket. To generate a new ARN, create a new IAM Role in your AWS admin console.
bucket required	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean Default: true If `true`, the S3 bucket connector is active and logs are being fetched to Layerlog. If `false`, the connector is disabled.
addS3ObjectKeyAsLogField	boolean Default: false If `true`, enriches logs with a new field detailing the S3 object key.
region required	string Enum: "US_EAST_1" "US_EAST_2" "US_WEST_1" "US_WEST_2" "EU_WEST_1" "EU_WEST_2" "EU_WEST_3" "EU_CENTRAL_1" "AP_NORTHEAST_1" "AP_NORTHEAST_2" "AP_SOUTHEAST_1" "AP_SOUTHEAST_2" "SA_EAST_1" "AP_SOUTH_1" "CA_CENTRAL_1" Specify one supported AWS region.
logsType required	string Enum: "elb" "vpcflow" "S3Access" "cloudfront" Specifies the log type being sent to Layerlog. Determines the parsing pipeline used to parse and map the logs. Learn more about parsing options supported by Layerlog.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"accessKey": "ee07df5801500745419c6dff",
"secretKey": "506d891fe2163a511b450eddc3279539f6",
"arn": "string",
"bucket": "AWS bucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true,
"addS3ObjectKeyAsLogField": true,
"region": "US_EAST_1",
"logsType": "elb"
}

Update an S3 bucket connector

put /v1/log-shipping/s3-buckets/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/s3-buckets/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/s3-buckets/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/s3-buckets/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/s3-buckets/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/s3-buckets/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/s3-buckets/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/s3-buckets/{id}

Updates connection details for an S3 bucket connector.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Layerlog ID of the S3 Bucket connector. You can run the relevant GET endpoints to retrieve the ID.

Request Body schema: application/json

accessKey	string AWS S3 bucket access key
secretKey	string AWS S3 bucket secret key
arn	string Amazon Resource Name (ARN) to uniquely identify the S3 bucket. To generate a new ARN, create a new IAM Role in your AWS admin console.
bucket required	string AWS S3 bucket name
prefix	string Prefix of the AWS S3 bucket
active	boolean Default: true If `true`, the S3 bucket connector is active and logs are being shipped to Layerlog. If `false`, the connector is disabled.
addS3ObjectKeyAsLogField	boolean Default: false If `true`, enriches logs with a new field detailing the S3 object key.
region required	string Enum: "US_EAST_1" "US_EAST_2" "US_WEST_1" "US_WEST_2" "EU_WEST_1" "EU_WEST_2" "EU_WEST_3" "EU_CENTRAL_1" "AP_NORTHEAST_1" "AP_NORTHEAST_2" "AP_SOUTHEAST_1" "AP_SOUTHEAST_2" "SA_EAST_1" "AP_SOUTH_1" "CA_CENTRAL_1" Specify one supported AWS region.
logsType required	string Enum: "elb" "vpcflow" "S3Access" "cloudfront" Specify the log type you will be sending to Layerlog. As a result, Layerlog will apply the appropriate parsing pipeline. Learn more about parsing options supported by Layerlog.

Responses

default

successful operation

Request samples

Payload

Content type

application/json

Copy

Expand all Collapse all


{"accessKey": "ee07df5801500745419c6dff",
"secretKey": "506d891fe2163a511b450eddc3279539f6",
"arn": "string",
"bucket": "AWS bucket",
"prefix": "AWSLogs/7364988021587/myprefix",
"active": true,
"addS3ObjectKeyAsLogField": true,
"region": "US_EAST_1",
"logsType": "elb"
}

Delete an S3 connector

delete /v1/log-shipping/s3-buckets/{id}

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/s3-buckets/{id}

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/s3-buckets/{id}

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/s3-buckets/{id}

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/s3-buckets/{id}

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/s3-buckets/{id}

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/s3-buckets/{id}

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/s3-buckets/{id}

Deletes an S3 bucket connector. As a result, the connected AWS resource will stop shipping logs to your Layerlog account.

Authorizations:

X-API-TOKEN

path Parameters

required

integer <int32>

Layerlog ID of the S3 bucket connector. You can run the relevant GET endpoints to retrieve the ID.

Responses

default

successful operation

Get account information for IAM Role

get /v1/log-shipping/s3-buckets/aws-assume-role-details

US East (Northern Virginia)

https://api.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

Canada (Central)

https://api-ca.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

Europe (London)

https://api-uk.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

West US 2 (Washington)

https://api-wa.layerlog.com/v1/log-shipping/s3-buckets/aws-assume-role-details

Returns the Layerlog parameters needed to create an AWS IAM Role in the AWS admin console.

The next steps after running this endpoint:

Open your AWS admin console and create a new IAM Role. Once the role is created, you will obtain an ARN for it. Keep it handy for the next step.
Create a new S3 bucket connector. Provide the ARN from the previous step in the request body.

Authorizations:

X-API-TOKEN

Responses

200

successful operation

Response Schema: application/json

logzioAWSAccountId	string Layerlog account ID. Provide this account ID when creating a new AWS IAM Role.
assignedExternalId	string Layerlog external ID. Provide this external ID when creating a new AWS IAM Role.

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"logzioAWSAccountId": null,
"assignedExternalId": null
}

Grafana alerting

To create an alert, use the Grafana dashboards API.

Get alerts

get /v1/grafana/api/alerts/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/alerts/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/alerts/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/alerts/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/alerts/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/alerts/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/alerts/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/alerts/

Retrieves alerts as per parameters given. The parameters are used as querystring parameters. For example: /api/alerts?dashboardId=1.

Authorizations:

X-API-TOKEN

query Parameters

dashboardId	integer Limit response to alerts in specified dashboard(s). You can specify multiple dashboards, e.g. `dashboardId=23&dashboardId=35`.
panelId	integer Limit response to alert for a specified panel on a dashboard.
query	string Limit response to alerts having a name like this value.
state	string Return alerts with one or more of the following alert states: `ALL`, `no_data`, `paused`, `alerting`, `ok`, `pending`. To specify multiple states use the following format: `?state=paused&state=alerting`.
limit	integer Limit response to X number of alerts.
folderId	integer Limit response to alerts of dashboards in specified folder(s). You can specify multiple folders, e.g. `folderId=23&folderId=35`.
dashboardQuery	integer Limit response to alerts having a dashboard name like this value.
dashboardTag	integer Limit response to alerts of dashboards with specified tags. To do an “AND” filtering with multiple tags, specify the tags parameter multiple times e.g. `dashboardTag=tag1&dashboardTag=tag2`.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
dashboardId	integer Dashboard ID.
dashboardUId	string Unique Identifier of the dashboard.
dashboardSlug	string Dashboard slug.
panelId	integer ID of the dashboard panel.
name	string Dashboard name.
state	string Dashboard state.
newStateDate	string New state date.
evalDate	string Evaluation date.
evalData	Array of strings Evaluation data.
executionError	string Execution error message, if present.
url	string Dashboard url.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/alerts?dashboardId=1 \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"dashboardId": 1,
"dashboardUId": "ABcdEFghij",
"dashboardSlug": "sensors",
"panelId": 1,
"name": "fire place sensor",
"state": "alerting",
"newStateDate": "2018-05-14T05:55:20+02:00",
"evalDate": "0001-01-01T00:00:00Z",
"evalData": 
["string"
],
"executionError": "",
"url": "http://grafana.com/dashboard/db/sensors"
}

Get alerts by Id

get /v1/grafana/api/alerts/:id

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/alerts/:id

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/alerts/:id

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/alerts/:id

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/alerts/:id

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/alerts/:id

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/alerts/:id

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/alerts/:id

Retrieves alerts by Id.

Authorizations:

X-API-TOKEN

path Parameters

required

integer

ID of the alert queried.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
dashboardId	integer Dashboard ID.
dashboardUId	string Unique Identifier of the dashboard.
dashboardSlug	string Dashboard slug.
panelId	integer ID of the dashboard panel.
name	string Dashboard name.
state	string Dashboard state.
newStateDate	string New state date.
evalDate	string Evaluation date.
evalData	Array of objects Evaluation data.
executionError	string Execution error message, if present.
url	string Dashboard url.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/alerts/1 \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>'

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"dashboardId": 1,
"dashboardUId": "ABcdEFghij",
"dashboardSlug": "sensors",
"panelId": 1,
"name": "fire place sensor",
"state": "alerting",
"newStateDate": "2018-05-14T05:55:20+02:00",
"evalDate": "0001-01-01T00:00:00Z",
"evalData": 
[
{"metric": "string",
"tags": 
{"name": "string"
},
"value": "string"
}
],
"executionError": "",
"url": "http://grafana.com/dashboard/db/sensors"
}

Pause alert by id

post /v1/grafana/api/alerts/:id/pause

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/alerts/:id/pause

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/alerts/:id/pause

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/alerts/:id/pause

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/alerts/:id/pause

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/alerts/:id/pause

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/alerts/:id/pause

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/alerts/:id/pause

Pauses alerts by Id.

Authorizations:

X-API-TOKEN

path Parameters

required

integer

ID of alert to be paused.

Request Body schema: application/json

paused

boolean

Can be true or false. True to pause an alert. False to unpause an alert.

Responses

200

successful query

Response Schema: application/json

alertId	integer Alert ID.
state	string Alert state.
message	string Response message.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"paused": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"alertId": 1,
"state": "Paused",
"message": "Alert paused"
}

Pause all alerts

post /v1/grafana/api/admin/pause-all-alerts

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/admin/pause-all-alerts

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/admin/pause-all-alerts

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/admin/pause-all-alerts

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/admin/pause-all-alerts

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/admin/pause-all-alerts

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/admin/pause-all-alerts

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/admin/pause-all-alerts

Pauses all alerts.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

paused

boolean

Can be true or false. True to pause an alert. False to unpause an alert.

Responses

200

successful query

Response Schema: application/json

alertId	integer Alert ID.
state	string State of alerts affected by request.
message	string Response message.
alertsAffected	integer List of alerts affected by request.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"paused": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"alertId": 1,
"state": "Paused",
"message": "Alert paused",
"alertsAffected": 1
}

Grafana annotations

Find annotations

get /v1/grafana/api/annotations/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/

Searches for annotations in the Grafana database.

Authorizations:

X-API-TOKEN

query Parameters

from	integer Epoch datetime in milliseconds. Optional.
to	integer Epoch datetime in milliseconds. Optional.
limit	integer Optional - default is 100. Max limit for results returned.
alertId	integer Optional. Find annotations for a specified alert.
dashboardId	integer Optional. Find annotations that are scoped to a specific dashboard
panelId	integer Optional. Find annotations that are scoped to a specific panel
userId	integer Optional. Find annotations created by a specific user
type	string Optional. Return alerts or user created annotations
tags	string Optional. Use this to filter global annotations. Global annotations are annotations from an annotation data source that are not connected specifically to a dashboard or panel. To do an “AND” filtering with multiple tags, specify the tags parameter multiple times e.g. tags=tag1&tags=tag2.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
dashboardId	integer Dashboard ID.
dashboardUId	string Dashboard UID.
dashboardSlug	string Dashboard slug.
panelId	integer Panel ID.
name	string Dashboard name.
state	string Dashboard state.
newStateDate	string Date of the new state.
evalDate	string Evaluation date.
evalData	Array of strings Evaluation data.
executionError	string Execution error, if present
url	string Dashboard url.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/annotations?from=1506676478816&to=1507281278816&tags=tag1&tags=tag2&limit=100 \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"dashboardId": 1,
"dashboardUId": "ABcdEFghij",
"dashboardSlug": "sensors",
"panelId": 1,
"name": "fire place sensor",
"state": "alerting",
"newStateDate": "2018-05-14T05:55:20+02:00",
"evalDate": "0001-01-01T00:00:00Z",
"evalData": 
["string"
],
"executionError": "",
"url": "http://grafana.com/dashboard/db/sensors"
}

Create annotations

post /v1/grafana/api/annotations/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/

Creates an annotation in the Grafana database.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

dashboardId	integer Id of the dashboard. The dashboardId and panelId fields are optional. If they are not specified then a global annotation is created and can be queried in any dashboard that adds the Grafana annotations data source.
panelId	integer Id of the panel. The dashboardId and panelId fields are optional. If they are not specified then a global annotation is created and can be queried in any dashboard that adds the Grafana annotations data source.
time	integer Epoch time in milliseconds.
timeEnd	integer Epoch time in milliseconds.
tags	Array of strings Annotation tags.
text	string Annotation Description.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
message	string Confirmation message.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"dashboardId": 0,
"panelId": 0,
"time": 0,
"timeEnd": 0,
"tags": 
["tag1"
],
"text": "string"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"message": "Annotation added"
}

Create annotations in Graphite format

post /v1/grafana/api/annotations/graphite

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/graphite

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/graphite

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/graphite

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/graphite

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/graphite

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/graphite

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/graphite

Creates an annotation in the Grafana database by using Graphite-compatible event format.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

what	string Graphite annotation.
when	integer Epoch datetime of the annotation in milliseconds. Optional. If `when` is not specified then the current time will be used as annotation’s timestamp..
tags	Array of strings Annotation tags. Can also be in prior to Graphite 0.10.0 format (string with multiple tags being separated by a space).
data	string Annotation Description.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
message	string Confirmation message.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"what": "Event - deploy",
"when": 0,
"tags": 
["deploy",
"production"
],
"data": "deploy of master branch happened at Wed Jul 6 22:34:41 UTC 2016"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"message": "Graphite annotation added"
}

Update annotations

put /v1/grafana/api/annotations/:id

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/:id

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/:id

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/:id

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/:id

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/:id

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/:id

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/:id

Updates an annotation in the Grafana database.

Authorizations:

X-API-TOKEN

path Parameters

required

integer

Id of the annotation.

Request Body schema: application/json

time	integer Epoch time in milliseconds.
timeEnd	integer Epoch time in milliseconds.
text	string Annotation Description.
tags	attay Tags.

Responses

200

successful query

Response Schema: application/json

message

string

Confirmation message.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"time": 0,
"timeEnd": "Event - deploy",
"text": "string",
"tags": 
["tag3",
"tag4",
"tag5"
]
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Annotation updated"
}

Patch annotations

patch /v1/grafana/api/annotations/:id

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/:id

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/:id

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/:id

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/:id

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/:id

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/:id

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/:id

Updates one or more properties of an annotation that matches the specified id. This operation currently supports updating of the text, tags, time and timeEnd properties.

Authorizations:

X-API-TOKEN

path Parameters

required

integer

Id of the annotation.

Request Body schema: application/json

text	string Annotation Description.
tags	attay Tags.

Responses

200

successful query

Response Schema: application/json

message

string

Confirmation message.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"text": "string",
"tags": null
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Annotation patched"
}

Delete annotation by id

delete /v1/grafana/api/annotations/:id

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/:id

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/:id

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/:id

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/:id

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/:id

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/:id

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/:id

Deletes the annotation that matches the specified id.

Authorizations:

X-API-TOKEN

path Parameters

required

integer

Id of the annotation.

Responses

200

successful query

Response Schema: application/json

message

string

Confirmation message.

Request samples

cURL

Copy

curl -X DELETE https://api.layerlog.com/v1/grafana/api/annotations/1141 \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Annotation deleted"
}

Get event tags created in annotations

get /v1/grafana/api/annotations/tags

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/annotations/tags

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/annotations/tags

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/annotations/tags

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/annotations/tags

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/annotations/tags

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/annotations/tags

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/annotations/tags

Searches for event tags in annotations in the Grafana database.

Authorizations:

X-API-TOKEN

query Parameters

tag	string Tag. Optional.
limit	integer Optional. A number, where the default is 100. Max limit for results returned.

Responses

200

successful query

Response Schema: application/json

result

object

Query result.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/annotations/tags?tag=out \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"result": 
{"tags": 
{"tag": "outage",
"count": 1
}
}
}

Grafana dashboards

Create/update a dashboard

post /v1/grafana/api/dashboards/db

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/db

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/db

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/db

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/db

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/db

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/db

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/db

Creates or updates a new dashboard or updates an existing dashboard.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

dashboard	object The complete dashboard model, to create a new dashboard.
folderId	integer The id of the folder to save the dashboard in.
folderUid	string The UID of the folder to save the dashboard in. Overrides the folderId.
message	string Set a commit message for the version history.
overwrite	boolean Set to true if you want to overwrite existing dashboard with newer version, same dashboard title in folder or same dashboard uid.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
uid	string UID.
url	string URL.
status	string Request status.
version	integer Dashboard version.
slug	string Dashboard slug.

412

failed

Response Schema: application/json

message	string Error message.
status	string Error status.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"dashboard": 
{"id": 1,
"uid": 1,
"panels": 
[
{"alert": 
{"alertRuleTags": { },
"conditions": 
[
{"evaluator": 
{"params": 
[0
],
"type": "string"
},
"operator": 
{"type": "string"
},
"query": 
{"params": 
["string"
]
},
"reducer": 
{"params": 
[null
],
"type": "string"
},
"type": "string"
}
],
"executionErrorState": "string",
"for": "string",
"frequency": "string",
"handler": 0,
"name": "string",
"noDataState": "string",
"notifications": 
[null
]
},
"aliasColors": { },
"bars": true,
"dashLength": 0,
"dashes": true,
"datasource": "string",
"fieldConfig": 
{"defaults": 
{"custom": { }
},
"overrides": 
[null
]
},
"fill": 0,
"fillGradient": 0,
"gridPos": 
{"h": 0,
"w": 0,
"x": 0,
"y": 0
},
"hiddenSeries": true,
"id": 0,
"legend": 
{"avg": true,
"current": true,
"max": true,
"min": true,
"show": true,
"total": true,
"values": true
},
"lines": true,
"linewidth": 0,
"nullPointMode": "string",
"options": 
{"dataLinks": 
[null
]
},
"percentage": true,
"pointradius": 0,
"points": true,
"renderer": "string",
"seriesOverrides": 
[null
],
"spaceLength": 0,
"stack": true,
"steppedLine": true,
"targets": 
[
{"refId": "string",
"scenarioId": "string"
}
],
"thresholds": 
[
{"colorMode": "string",
"fill": true,
"line": true,
"op": "string",
"value": 0
}
],
"timeFrom": "string",
"timeRegions": 
[null
],
"timeShift": "string",
"title": "string",
"tooltip": 
{"shared": true,
"sort": 0,
"value_type": "string"
},
"type": "string",
"xaxis": 
{"buckets": "string",
"mode": "string",
"name": "string",
"show": true,
"values": 
[null
]
},
"yaxes": 
[
{"format": "string",
"label": "string",
"logBase": 0,
"max": "string",
"min": "string",
"show": true
}
],
"yaxis": 
{"align": true,
"alignLevel": "string"
}
}
],
"title": "Production Overview",
"tags": 
["tag3"
],
"timezone": "browser",
"schemaVersion": 1,
"version": 0,
"refresh": "25s"
},
"folderId": 1,
"folderUid": "l3KqBxCMz",
"message": "Made changes to xyz",
"overwrite": true
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"uid": "cIBgcSjkk",
"url": "/d/cIBgcSjkk/production-overview",
"status": "success",
"version": 1,
"slug": "production-overview"
}

Get dashboard by uid

get /v1/grafana/api/dashboards/uid/:uid

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/uid/:uid

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/uid/:uid

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Will return the dashboard given the dashboard unique identifier (uid). Information about the unique identifier of a folder containing the requested dashboard might be found in the metadata.

Authorizations:

X-API-TOKEN

path Parameters

uid

required

string

Dashboard UID.

Responses

200

success

Response Schema: application/json

dashboard	object The complete dashboard model, `id = null` to create a new dashboard.
meta	object Information about the unique identifier of a folder containing the requested dashboard.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/dashboards/uid/cIBgcSjkk \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \
  -d '{
        "dashboard": {
          "id": 1,
          "uid": "cIBgcSjkk",
          "title": "Production Overview",
          "tags": [ "templated" ],
          "timezone": "browser",
          "schemaVersion": 16,
          "version": 0
        },
        "meta": {
          "isStarred": false,
          "url": "/d/cIBgcSjkk/production-overview",
          "folderId": 2,
          "folderUid": "l3KqBxCMz",
          "slug": "production-overview" //deprecated in Grafana v5.0
        }
  }'

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"dashboard": 
{"id": 1,
"uid": 1,
"title": "Production Overview",
"tags": 
["tag3"
],
"timezone": "browser",
"schemaVersion": 1,
"version": 0
},
"meta": 
{"isStarred": true,
"url": "/d/cIBgcSjkk/production-overview",
"folderId": 2,
"folderUid": "l3KqBxCMz",
"slug": "production-overview"
}
}

Delete dashboard by uid

delete /v1/grafana/api/dashboards/uid/:uid

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/uid/:uid

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/uid/:uid

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/uid/:uid

Will delete the dashboard given the specified unique identifier (uid).

Authorizations:

X-API-TOKEN

path Parameters

uid

required

string

Dashboard UID.

Responses

200

success

Response Schema: application/json

title	object Dashboard title.
message	object Response message.
id	integer Dashboard id.

Request samples

cURL

Copy

curl -X DELETE https://api.layerlog.com/v1/grafana/api/dashboards/uid/cIBgcSjkk \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \
  -d '{
        "title": "Production Overview",
        "message": "Dashboard Production Overview deleted",
        "id": 2
  }'

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"title": "Production Overview",
"message": { },
"id": 2
}

Get home dashboard

get /v1/grafana/api/dashboards/home

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/home

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/home

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/home

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/home

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/home

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/home

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/home

Will return the home dashboard.

Authorizations:

X-API-TOKEN

Responses

200

success

Response Schema: application/json

dashboard	object The complete dashboard model, `id = null` to create a new dashboard.
meta	object The complete dashboard model, `id = null` to create a new dashboard.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/dashboards/home \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"dashboard": 
{"editable": false,
"hideControls": false,
"nav": 
{"enable": false,
"type": "timepicker"
},
"style": "dark",
"tags": 
{"tag": "outage"
},
"templating": 
{"list": 
["string"
]
},
"time": { },
"timezone": "browser",
"title": "Home",
"version": 2
},
"meta": 
{"isHome": true,
"canSave": false,
"canEdit": false,
"canStar": false,
"url": "url",
"expires": "2025-12-07T12:21:52.948Z",
"created": "2025-12-07T12:21:52.948Z"
}
}

Get all tags of dashboards

get /v1/grafana/api/dashboards/tags

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/tags

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/tags

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/tags

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/tags

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/tags

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/tags

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/tags

Will return all tags for all dashboard.

Authorizations:

X-API-TOKEN

Responses

200

success

Response Schema: application/json

Array

term	string Tag term.
count	string Tag count.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/dashboards/tags \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


[
{"term": "tag1",
"count": "count1"
}
]

Get all dashboard versions

get /v1/grafana/api/dashboards/id/:dashboardId/versions

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions

Gets all existing dashboard versions for the dashboard with the given dashboardId.

Authorizations:

X-API-TOKEN

path Parameters

dashboardId

required

integer

Dashboard ID.

query Parameters

limit	integer Maximum number of results to return.
start	integer Version to start from when returning queries.

Responses

200

success

Response Schema: application/json

id	integer ID.
dashboardId	integer Dashboard ID.
parentVersion	integer Dashboard parent version.
restoredFrom	integer Restored from.
version	integer Version.
created	integer Date created.
createdBy	string Created by.
message	string Message.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/dashboards/id/1/versions?limit=2?start=0 \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"dashboardId": 2,
"parentVersion": 0,
"restoredFrom": 0,
"version": 2,
"created": "2017-06-08T17:24:33-04:00\"",
"createdBy": "admin",
"message": "Initial save"
}

Get dashboard version

get /v1/grafana/api/dashboards/id/:dashboardId/versions/:id

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/versions/:id

Get the dashboard version with the given id, for the dashboard with the given id.

Authorizations:

X-API-TOKEN

path Parameters

dashboardId required	integer Dashboard ID.
id required	integer Version ID.

Responses

200

success

Response Schema: application/json

id	integer ID.
dashboardId	integer Dashboard ID.
parentVersion	integer Parent version.
restoredFrom	integer Restored from.
version	integer Version.
created	string Creation date.
message	string Message.
data	object Data.
createdBy	string Created by.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/dashboards/id/1/versions/1 \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 1,
"dashboardId": 1,
"parentVersion": 0,
"restoredFrom": 0,
"version": 1,
"created": "2025-12-07T12:21:52.948Z",
"message": "Initial save",
"data": 
{"annotations": 
{"list": 
[null
]
},
"editable": true,
"gnetId": "string",
"graphTooltip": 0,
"hideControls": true,
"id": 1,
"links": 
[null
],
"rows": 
[
{"collapse": true,
"height": "250px",
"panels": 
[null
],
"repeat": "string",
"repeatIteration": "string",
"repeatRowId": "string",
"showTitle": true,
"title": "Dashboard Row",
"titleSize": "h6"
}
],
"schemaVersion": "14",
"style": "dark",
"tags": 
[null
],
"templating": 
{"list": 
[null
]
},
"time": 
{"from": "now-6h",
"to": "now"
},
"timepicker": 
{"refresh_intervals": 
["5s"
],
"time_options": 
["5m"
]
},
"timezone": "browser",
"title": "test",
"version": 1
},
"createdBy": "admin"
}

Restore a dashboard

post /v1/grafana/api/dashboards/id/:dashboardId/restore

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/id/:dashboardId/restore

Restores a dashboard to a given dashboard version.

Authorizations:

X-API-TOKEN

path Parameters

dashboardId

required

integer

Dashboard ID.

Request Body schema: application/json

version

integer

Dashboard version.

Responses

200

successful query

Response Schema: application/json

slug	string Dashboard slug.
status	string Dashboard status.
version	integer Dashboard version.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"version": 0
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"slug": "production-overview",
"status": "success",
"version": 1
}

Compare dashboards

post /v1/grafana/api/dashboards/calculate-diff

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/dashboards/calculate-diff

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/dashboards/calculate-diff

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/dashboards/calculate-diff

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/dashboards/calculate-diff

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/dashboards/calculate-diff

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/dashboards/calculate-diff

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/dashboards/calculate-diff

Compares two dashboard versions by calculating the JSON diff of them.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

base	object Object representing the base dashboard version.
new	object Object representing the new dashboard version
diffType	string the type of diff to return. Can be “json” or “basic”.

Responses

200

successful query

Response Schema: application/json

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"base": 
{"dashboardId": 1,
"version": 1
},
"new": 
{"dashboardId": 1,
"version": 1
},
"diffType": "string"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all

{ }

Grafana dashboard search

Search folders and dashboards

get /v1/grafana/api/search/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/search/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/search/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/search/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/search/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/search/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/search/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/search/

Search folders and dashboards.

Authorizations:

X-API-TOKEN

query Parameters

query	string Search query.
tag	string List of tags to search for.
type	string Type to search for, dash-folder or dash-db.
dashboardIds	integer List of dashboard id’s to search for.
folderIds	integer List of folder id’s to search in for dashboards.
starred	boolean Flag indicating if only starred Dashboards should be returned.
limit	integer Limit the number of returned results (max 5000).
page	integer Use this parameter to access hits beyond limit. Numbering starts at 1. limit param acts as page size. Only available in Grafana v6.2+.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
uid	string UID.
title	string Title.
url	string URL.
type	string Type.
tags	Array of any Tags.
isStarred	boolean Whether the dashboard is starred.
uri	string URI.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/search?query=Production%20Overview&starred=true&tag=prod \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 163,
"uid": "000000163",
"title": "Folder",
"url": "/dashboards/f/000000163/folder",
"type": "dash-folder",
"tags": 
[null
],
"isStarred": true,
"uri": "db/folder"
}

Grafana snapshots

Create a snapshot

post /v1/grafana/api/snapshots/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/snapshots/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/snapshots/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/snapshots/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/snapshots/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/snapshots/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/snapshots/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/snapshots/

Creates a snapshot.

Authorizations:

X-API-TOKEN

Request Body schema: application/json

dashboard	object The complete dashboard model.
name	string Snapshot name.
expires	integer When the snapshot should expire in seconds. 3600 is 1 hour, 86400 is 1 day. Default is never to expire.
external	boolean Save the snapshot on an external server rather than locally. Default is false.
key	string Define the unique key. Required if external is true.
deleteKey	string Unique key used to delete the snapshot. It is different from the key so that only the creator can delete the snapshot. Required if external is true.

Responses

200

successful query

Response Schema: application/json

deleteKey	string Unique key used to delete the snapshot. It is different from the `key` so that only the creator can delete the snapshot. Required if external is `true`.
deleteUrl	string Delete url.
key	string Unique key.
url	string URL.
id	integer ID.

Request samples

Payload
cURL

Content type

application/json

Copy

Expand all Collapse all


{"dashboard": { },
"name": "string",
"expires": 0,
"external": true,
"key": "string",
"deleteKey": "string"
}

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"deleteKey": "XXXXXXX",
"deleteUrl": "myurl/api/snapshots-delete/XXXXXXX",
"key": "YYYYYYY",
"url": "myurl/dashboard/snapshot/YYYYYYY",
"id": 1
}

Get list of Snapshots

get /v1/grafana/api/snapshots/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/snapshots/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/snapshots/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/snapshots/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/snapshots/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/snapshots/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/snapshots/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/snapshots/

Get list of Snapshots.

Authorizations:

X-API-TOKEN

query Parameters

query	string Search query.
limit	integer Limit the number of returned results.

Responses

200

successful query

Response Schema: application/json

id	integer ID.
name	string Snapshot name.
key	string Snapshot key.
orgId	integer Snapshot orgId.
userId	integer Snapshot user ID.
external	boolean Whether the snapshot is external.
externalUrl	string Snapshot external url.
expires	string Snapshot expiry date.
created	string Snapshot creation date.
updated	string Snapshot update date.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/dashboards/snapshots \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"id": 8,
"name": "Home",
"key": "YYYYYYY",
"orgId": 1,
"userId": 1,
"external": true,
"externalUrl": "string",
"expires": "2025-12-07T12:21:52.949Z",
"created": "2025-12-07T12:21:52.949Z",
"updated": "2025-12-07T12:21:52.949Z"
}

Get Snapshot by Key

get /v1/grafana/api/snapshots/:key/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/snapshots/:key/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/snapshots/:key/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/snapshots/:key/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/snapshots/:key/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/snapshots/:key/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/snapshots/:key/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/snapshots/:key/

Gets Snapshot by Key.

Authorizations:

X-API-TOKEN

path Parameters

key

required

string

Responses

200

successful query

Response Schema: application/json

meta	object
dashboard	object Dashboard.

Request samples

cURL

Copy

curl -X GET https://api.layerlog.com/v1/grafana/api/snapshots/YYYYYYY \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"meta": 
{"isSnapshot": true,
"type": "snapshot",
"canSave": true,
"canEdit": true,
"canStar": true,
"slug": null,
"expires": "2025-12-07T12:21:52.949Z",
"created": "2025-12-07T12:21:52.949Z"
},
"dashboard": 
{"editable": true,
"hideControls": true,
"nav": 
[
{"enable": true,
"type": "timepicker"
}
],
"rows": 
[{ }
],
"style": "dark",
"tags": 
[null
],
"templating": 
{"list": 
[null
]
},
"time": { },
"timezone": "browser",
"title": "Home",
"version": 5
}
}

Delete Snapshot by Key

delete /v1/grafana/api/snapshots/:key/

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/snapshots/:key/

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/snapshots/:key/

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/snapshots/:key/

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/snapshots/:key/

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/snapshots/:key/

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/snapshots/:key/

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/snapshots/:key/

Deletes snapshot by Key.

Authorizations:

X-API-TOKEN

path Parameters

key

required

string

Responses

200

successful query

Response Schema: application/json

message	string Message.
id	integer ID.

Request samples

cURL

Copy

curl -X DELETE https://api.layerlog.com/v1/grafana/api/snapshots/YYYYYYY \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Snapshot deleted. It might take an hour before it's cleared from any CDN caches.",
"id": 1
}

Delete snapshot by deleteKey

get /v1/grafana/api/snapshots-delete/:deleteKey

US East (Northern Virginia)

https://api.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

Asia Pacific (Sydney)

https://api-au.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

Canada (Central)

https://api-ca.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

Europe (Frankfurt)

https://api-eu.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

West Europe (Netherlands)

https://api-nl.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

Europe (London)

https://api-uk.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

West US 2 (Washington)

https://api-wa.layerlog.com/v1/grafana/api/snapshots-delete/:deleteKey

Delete snapshot by deleteKey.

Authorizations:

X-API-TOKEN

path Parameters

deleteKey

required

string

Responses

200

successful query

Response Schema: application/json

message	string Message.
id	integer ID.

Request samples

cURL

Copy

curl -X DELETE https://api.layerlog.com/v1/grafana/api/snapshots-delete/XXXXXX \
  -H 'Content-Type: application/json' \
  -H 'X-API-TOKEN: <token>' \

Response samples

Content type

application/json

Copy

Expand all Collapse all


{"message": "Snapshot deleted. It might take an hour before it's cleared from any CDN caches.",
"id": 1
}

Layerlog API

Introduction

Account region and API URL

Authentication

X-API-TOKEN

Rate limiting

Search logs

Search logs

Authorizations:

query Parameters

Request Body schema: application/json

Limitations

Notes on the search time range

Limitations

Limitations

Responses

Response Schema: application/json

Request samples

Response samples

Scroll logs

Authorizations:

Request Body schema: application/json

Limitations

Limitations

Limitations

Limitations

Responses

Response Schema: application/json

Request samples

Response samples

Alerts

Retrieve all alerts

Authorizations:

Responses

Response Schema: application/json

Response samples

Create an alert

Authorizations:

Request Body schema: application/json

Responses

Response Schema: application/json

Request samples

Response samples

Retrieve alert by ID

Authorizations:

path Parameters

Responses

Response Schema: application/json

Response samples

Update an alert

Authorizations:

path Parameters

Request Body schema: application/json

Responses

Response Schema: application/json

Request samples

Response samples

Delete an alert

Authorizations:

path Parameters

Responses

Response Schema: application/json

Response samples

Enable alert by ID

Authorizations:

path Parameters

Responses

Disable alert by ID

Authorizations:

path Parameters

Responses

Retrieve triggered alerts

Authorizations:

query Parameters

Responses

Response Schema: application/json

Request samples

Response samples

Deployments

Add deployment markers to Exception graphs