How to Export LogPoint Logs with the Search API
Summary
A tutorial shows how to export LogPoint logs through its Search API, retrieve results in two calls, avoid common query and time-range errors, and upload the output to LogTotal for review.
Key points
- The Search API uses two form-encoded POST requests to /getsearchlogs: one starts a search and returns a search_id; the other retrieves results when the search is final.
- Requests use a LogPoint username and secret key, which the article advises treating like a password.
- For incident work, use epoch seconds for the time range; search repositories use the format <ip>:5504/<repo>.
- Use a plain filter query to return logs; queries with aggregations such as chart return aggregated rows instead.
- The example saves results as JSONL and extracts raw messages from the msg field.
- The troubleshooting guidance covers incorrect credentials, repository names, millisecond timestamps, result limits, and requests not sent as form data.
Article Details
- Topic
- Exporting LogPoint logs through its Search API for review in LogTotal