Logpresso

https://docs.logpresso.com/en
Admin
Learn how to use Logpresso queries, user interfaces, SDKs, and REST APIs.
Tokens:748,666
Snippets:7,701
Trust Score:7.2
Update:4 months ago
Show doc for...
Tokens:
Raw
### Start App Installation cURL Example

Source: https://docs.logpresso.com/en/sonar/5.0/api/start-install-app

Use this cURL command to start the installation of an app package using its upload token. Ensure you replace HOSTNAME and API_KEY with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     -H "Content-Type: application/json" \
     -X POST \
     -d '{"token": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}' \
     https://HOSTNAME/api/sonar/apps/start-install
```

--------------------------------

### Get App Install Progress cURL Example

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-install-progress

Use this cURL command to make a GET request to the /api/sonar/apps/install-progress endpoint. Replace HOSTNAME with your Sonar instance hostname and <API_KEY> with your authentication token. The token parameter is a 36-character GUID representing the install session.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/apps/install-progress?token=a1b2c3d4-e5f6-7890-abcd-ef1234567890"
```

--------------------------------

### Install and Start Sample App Bundle

Source: https://docs.logpresso.com/en/app-sdk/install-sample-app

Install the application bundle using the `bundle.install` command, specifying the file path. Then, start the installed bundle using the `bundle.start` command with the bundle ID.

```bash
logpresso> bundle.install file:///C:\github\logpresso-app-examples\logpresso-sample-app\target\logpresso-sample-app-1.0.2306.0.jar
bundle [133] loaded

logpresso> bundle.start 133
bundle 133 started.
```

--------------------------------

### cURL Example for Get Explanations

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-explanations

Use this cURL command to retrieve explanation history. Ensure you replace `<API_KEY>` with your actual API key and provide a valid GUID and type.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/explanations?guid=a1b2c3d4-e5f6-7890-abcd-ef1234567890&type=EXPLANATION"
```

--------------------------------

### cURL Example for Get Connect Profile Test

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-connect-profile-test

Demonstrates how to call the API to retrieve the status of a specific connect profile test using its GUID. Ensure you replace `<API_KEY>` and `HOSTNAME` with your actual credentials and server address.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/connect-profiles/test/f2e4c1d3-9b21-4f0a-8de7-5b3a91f8c6a2
```

--------------------------------

### cURL Example for Getting Logger Factory Options

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-logger-factory-options

Use this cURL command to retrieve the configuration options for a logger factory. Replace HOSTNAME and the GUID with your actual values. Requires the GUEST role or higher.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/logger-factories/27102ae5-3698-44d4-aad5-4f2def80f275/local/syslog/options
```

--------------------------------

### Get App Install Progress

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-install-progress

Retrieves the progress of the app installation identified by the install token. The response includes overall progress as well as per-node progress across the cluster.

```APIDOC
## GET /api/sonar/apps/install-progress

### Description
Retrieves the progress of the app installation identified by the install token. The response includes overall progress as well as per-node progress across the cluster.

### Method
GET

### Endpoint
/api/sonar/apps/install-progress

### Parameters
#### Query Parameters
- **token** (String) - Required - Install session token. Must be a 36-character GUID.

### Request Example
```curl
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/apps/install-progress?token=a1b2c3d4-e5f6-7890-abcd-ef1234567890"
```

### Response
#### Success Response (200)
- **install_progress** (Object) - Installation progress. Included only when the install session exists.
  - **total_progress** (32-bit integer) - Overall progress (0 to 100)
  - **total_node** (32-bit integer) - Number of target nodes
  - **completed_node** (32-bit integer) - Number of nodes that completed installation
  - **status** (String) - Installation status (`standby`, `in_progress`, `completed`, `error`)
  - **is_cancelled** (Boolean) - Whether the installation has been cancelled
  - **error_code** (String) - Overall installation error code. `null` while running normally. Possible values: `timeout-error`, `disk-space-error`, `connection-error`, `dependency-error`, `general-error`, `app-object-error`.
  - **node_progresses** (Array) - Per-node progress
    - **node_name** (String) - Node name
    - **node_guid** (String) - Node GUID
    - **node_type** (String) - Node type (`control`, `data`, `forwarder`, etc.)
    - **node_progress** (32-bit integer) - Node progress (0 to 100)
    - **error_code** (String) - Per-node error code. `null` while running normally.

#### Response Example
```json
{
  "install_progress": {
    "total_progress": 50,
    "total_node": 2,
    "completed_node": 1,
    "status": "in_progress",
    "is_cancelled": false,
    "error_code": null,
    "node_progresses": [
      {
        "node_name": "control-node-1",
        "node_guid": "b2c3d4e5-f678-9012-bcde-f12345678901",
        "node_type": "control",
        "node_progress": 100,
        "error_code": null
      },
      {
        "node_name": "data-node-1",
        "node_guid": "c3d4e5f6-7890-1234-cdef-123456789012",
        "node_type": "data",
        "node_progress": 50,
        "error_code": null
      }
    ]
  }
}
```

#### Error Responses
- **400 Bad Request**: `token` is missing or not in valid GUID format.
  ```json
  {
    "error_code": "invalid-param-type",
    "error_msg": "token should be guid type."
  }
  ```
- **500 Internal Server Error**: Permission denied.
  ```json
  {
    "error_code": "illegal-state",
    "error_msg": "no-permission"
  }
  ```
```

--------------------------------

### POST /api/sonar/apps/start-install

Source: https://docs.logpresso.com/en/sonar/5.0/api/start-install-app

Starts the installation of the app package identified by the upload token. The server returns the validation result (`installable_status`) and proceeds with the installation in the background when validation passes. Requires ADMIN role or higher.

```APIDOC
## POST /api/sonar/apps/start-install

### Description
Starts the installation of the app package identified by the upload token. The server returns the validation result (`installable_status`) and proceeds with the installation in the background when validation passes. Requires ADMIN role or higher.

### Method
POST

### Endpoint
/api/sonar/apps/start-install

### Parameters
#### Request Body Parameters
- **token** (String) - Required - Install token issued when the app package was uploaded. Must be a 36-character GUID.
- **overwrite** (Boolean) - Optional - Whether to overwrite if the same app is installed. If omitted, only new installation is allowed.

### Request Example
```json
{
  "token": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
```

### Response
#### Success Response (200)
- **installable_status** (Object) - Installability validation result.
  - **is_valid** (Boolean) - Whether the package is installable (`true`: installation proceeds, `false`: not installable).
  - **reason** (String) - Reason the package is not installable. Included only when `is_valid` is `false`. Possible values: `version-mismatch`, `already-installed`, `invalid-file`, `invalid-manifest`, `dependency-unresolved`, `invalid-object`, `inner-app`.
  - **app_code** (String) - Code of the existing installed app. Included only when `reason` is `version-mismatch` or `already-installed`.
  - **app_name** (String) - Name of the existing installed app. Included only when `reason` is `version-mismatch` or `already-installed`.
  - **app_version** (String) - Version of the existing installed app. Included only when `reason` is `version-mismatch` or `already-installed`.
- **result** (Boolean) - `false` when installation fails to start. Not included on successful start or when overwrite can resolve the issue.
- **error_msg** (String) - Reason installation failed to start. Included when `result` is `false`.

#### Response Example (Success)
```json
{
  "installable_status": {
    "is_valid": true,
    "reason": null
  }
}
```

#### Response Example (Already Installed, Overwrite Possible)
```json
{
  "installable_status": {
    "is_valid": false,
    "reason": "already-installed",
    "app_code": "logpresso-sample-app",
    "app_name": "Sample App",
    "app_version": "1.0.0"
  }
}
```

#### Response Example (Installation Failed to Start)
```json
{
  "installable_status": {
    "is_valid": false,
    "reason": "invalid-file"
  },
  "result": false,
  "error_msg": "app installation failed to start: installable status: isValid = [false], reason = [invalid-file], appCode = [null], appFile = [/opt/logpresso/sonar/upload/sample.jar]"
}
```

#### Error Responses
- **400 Bad Request** - `token` is missing or not in valid GUID format.
  ```json
  {
    "error_code": "invalid-param-type",
    "error_msg": "token should be guid type."
  }
  ```
- **500 Internal Server Error** - Install session has expired.
  ```json
  {
    "error_code": "illegal-state",
    "error_msg": "main install session was expired : token-[a1b2c3d4-e5f6-7890-abcd-ef1234567890]"
  }
  ```
- **500 Internal Server Error** - Install step already proceeded.
  ```json
  {
    "error_code": "illegal-state",
    "error_msg": "main install session alreay START_INSTALL_APP : token-[a1b2c3d4-e5f6-7890-abcd-ef1234567890] app symbol-[com.logpresso.sample.app]"
  }
  ```
- **500 Internal Server Error** - Permission denied.
  ```json
  {
    "error_code": "illegal-state",
    "error_msg": "no-permission"
  }
  ```
```

--------------------------------

### cURL Example for Get Lookup Schema

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-lookup

Use this cURL command to make a GET request to retrieve a lookup schema by its GUID. Replace HOSTNAME and the GUID with your specific values. Requires an API key for authorization.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/lookups/76b8699d-91a1-4576-a908-7db753570a0a
```

--------------------------------

### cURL Example for Getting Patterns

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-patterns

Use this cURL command to make a GET request to retrieve patterns for a given pattern group GUID. Ensure you replace HOSTNAME and the GUID with your actual values. Authentication is handled via an API key.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/pattern-groups/8df64276-a16e-4bae-93cd-c207c8155159/patterns
```

--------------------------------

### App Installation Response - Cannot Start

Source: https://docs.logpresso.com/en/sonar/5.0/api/start-install-app

This response is returned when the app cannot be installed due to an invalid file or other unresolvable issues, even if overwrite is attempted. The `error_msg` provides specific details.

```json
{
  "installable_status": {
    "is_valid": false,
    "reason": "invalid-file"
  },
  "result": false,
  "error_msg": "app installation failed to start: installable status: isValid = [false], reason = [invalid-file], appCode = [null], appFile = [/opt/logpresso/sonar/upload/sample.jar]"
}
```

--------------------------------

### Load Sample Web Server Logs

Source: https://docs.logpresso.com/en/query/preparing-sample-data

Fetches sample access log data from a GitHub repository, parses it, and imports it into the WEB_APACHE_SAMPLE table. Ensure the WEB_APACHE_SAMPLE table is created beforehand.

```logql
wget url="https://raw.githubusercontent.com/logpresso/dataset/refs/heads/main/access.log"
| eval lines=split(line, "\n") | explode lines | eval line=lines | search line != ""
| rex field=line "(?<src_ip>\S+) - - \[(?<\_time>[^\]]+)\] \"(?<request>[^\"]*)\" (?<status>\d+) (?<bytes>\S+) \"(?<referer>[^\"]*)\" \"(?<agent>[^\"]*)\""
| rex field=request "(?<method>\S+)(?: (?<uri>\S+) (?<protocol>\S+))?"
| eval _time=date(_time, "dd/MMM/yyyy:HH:mm:ss Z", "en"), src_ip=ip(src_ip), status=int(status), bytes=int(bytes)
| fields _time, src_ip, method, uri, protocol, status, bytes, referer, agent, line
| import WEB_APACHE_SAMPLE
```

--------------------------------

### cURL Example for Getting System Variables

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-system-variables

Use this cURL command to make a GET request to retrieve system variables for a specific node pair GUID. Ensure you replace HOSTNAME and the GUID with your actual values. Requires MASTER role or higher.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/system-variables/a1b2c3d4-e5f6-7890-abcd-ef1234567890
```

--------------------------------

### Example Procedure Query with Parameter

Source: https://docs.logpresso.com/en/sonar/5.0/ui/section-procedure

This query demonstrates how to use a parameter within a procedure. The `$(

```logpresso
table *:SNIPER_NGFW | search level == $("level")

```

--------------------------------

### cURL Example for Get Glossary Term

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-glossary-term

Use this cURL command to make a GET request to retrieve a specific glossary term. Replace HOSTNAME and :guid with your actual hostname and the term's GUID. Requires an API key with ADMIN role or higher.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/glossary/terms/:guid"
```

--------------------------------

### Success Response Example for Get Report Groups

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-report-groups

This is an example of a successful response when retrieving report groups. It returns an array of report group objects, each with details like GUID, name, and timestamps.

```json
{
  "report_groups": [
    {
      "guid": "8cdf8f7e-ebc6-4100-88f8-e97297cf5fc2",
      "name": "Report group",
      "description": null,
      "owner_guid": "ce23adf2-13e4-40f9-ad0c-74d090b1f10c",
      "owner_name": "Demo",
      "parent_guid": null,
      "created_at": "2024-08-08 10:28:17+0900",
      "updated_at": "2024-08-08 10:28:17+0900"
    }
  ]
}
```

--------------------------------

### Build Logpresso Sample App with Maven

Source: https://docs.logpresso.com/en/app-sdk/build-sample-app

Navigate to the sample app directory and run the Maven clean package command. This command compiles the code, runs tests, and bundles the application into a JAR file.

```bash
cmd> mvn clean package
[INFO] Scanning for projects...
[INFO] 
[INFO] --------------< com.logpresso.sonar:logpresso-sample-app >--------------
[INFO] Building Logpresso Sample App 1.0.2306.0
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO] 
[INFO] --- maven-clean-plugin:2.5:clean (default-clean) @ logpresso-sample-app ---
[INFO] Deleting C:\github\logpresso-app-examples\logpresso-sample-app\target
[INFO] 
[INFO] --- maven-resources-plugin:3.3.1:resources (default-resources) @ logpresso-sample-app ---
[INFO] skip non existing resourceDirectory C:\github\logpresso-app-examples\logpresso-sample-app\src\main\resources
[INFO] 
[INFO] --- maven-compiler-plugin:3.8.1:compile (default-compile) @ logpresso-sample-app ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 9 source files to C:\github\logpresso-app-examples\logpresso-sample-app\target\classes
[INFO] 
[INFO] --- maven-resources-plugin:3.3.1:testResources (default-testResources) @ logpresso-sample-app ---
[INFO] skip non existing resourceDirectory C:\github\logpresso-app-examples\logpresso-sample-app\src\test\resources
[INFO] 
[INFO] --- maven-compiler-plugin:3.8.1:testCompile (default-testCompile) @ logpresso-sample-app ---
[INFO] No sources to compile
[INFO] 
[INFO] --- maven-surefire-plugin:3.1.2:test (default-test) @ logpresso-sample-app ---
[INFO] No tests to run.
[INFO] 
[INFO] --- maven-bundle-plugin:5.1.9:bundle (default-bundle) @ logpresso-sample-app ---
[WARNING] Bundle com.logpresso.sonar:logpresso-sample-app:bundle:1.0.2306.0 : Unused Import-Package instructions: [com.logpresso.sonar.api.*]
[INFO] Building bundle: C:\github\logpresso-app-examples\logpresso-sample-app\target\logpresso-sample-app-1.0.2306.0.jar
[INFO] Writing manifest: C:\github\logpresso-app-examples\logpresso-sample-app\target\classes\META-INF\MANIFEST.MF
[INFO] 
[INFO] --- maven-ipojo-plugin:1.12.1.asm8:ipojo-bundle (default) @ logpresso-sample-app ---
[INFO] Start bundle manipulation
[INFO] No metadata file found - trying to use only annotations
[INFO] Input Bundle File : C:\github\logpresso-app-examples\logpresso-sample-app\target\logpresso-sample-app-1.0.2306.0.jar
[INFO] Apache Felix iPOJO Manipulator - 1.12.1.asm8
[INFO] Bundle manipulation - SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  5.132 s
[INFO] Finished at: 2023-06-10T22:38:33+09:00
[INFO] ------------------------------------------------------------------------

```

--------------------------------

### SampleServiceImpl Implementation

Source: https://docs.logpresso.com/en/app-sdk/add-query-command-parser

This Java code demonstrates how to add and remove query command parsers using the QueryParserService. It initializes parsers on startup and removes them on stop.

```java
import org.springframework.stereotype.Component;
import org.springframework.stereotype.Service;

import com.logpresso.core.app.query.parser.QueryParserService;
import com.logpresso.core.app.query.parser.ConnectProfileQueryCommandParser;
import com.logpresso.core.app.connect.ConnectProfileService;

import java.util.Arrays;
import java.util.List;

@Component(name = "sample-service")
@Instantiate
public class SampleServiceImpl {

	@Requires
	private QueryParserService queryParserService;

	@Requires
	private ConnectProfileService connectProfileService;

	private SampleQueryCommandParser subnetGroupsParser = new SampleSubnetGroupsCommandParser();
	private SampleQueryCommandParser createSubnetGroupParser = new SampleCreateSubnetGroupCommandParser();

	@Validate
	public void start() {
		for (SampleQueryCommandParser parser : getParsers()) {
			parser.setConnectProfileService(connectProfileService);
			queryParserService.addCommandParser(parser);
		}
	}

	@Invalidate
	public void stop() {
		if (queryParserService == null)
			return;

		for (SampleQueryCommandParser parser : getParsers()) {
			parser.setConnectProfileService(null);
			queryParserService.removeCommandParser(parser);
		}
	}

	private List<SampleQueryCommandParser> getParsers() {
		return Arrays.asList(subnetGroupsParser, createSubnetGroupParser);
	}
}

```

--------------------------------

### cURL Example for Getting Ticket Attachments

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-ticket-attachments

Use this cURL command to make a GET request to retrieve attachments for a given ticket GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/tickets/8de3c683-a793-4bde-bf41-657396d17ef5/attachments
```

--------------------------------

### Sample App Response

Source: https://docs.logpresso.com/en/sonar/5.0/api/chapter-apps-api

This is an example of a successful response when retrieving a list of apps. It includes details such as app code, name, version, and installation status.

```json
{
  "total_count": 1,
  "apps": [
    {
      "code": "logpresso-sample-app",
      "name": "Sample App",
      "bundle_symbolic_name": "com.logpresso.sample.app",
      "version": "1.0.0",
      "description": "Sample app description",
      "icon": "data:image/png;base64,iVBORw0KGgo...",
      "built_at": "2024-09-01 09:00:00+0900",
      "installed_at": "2024-09-15 14:30:00+0900",
      "enabled": true
    }
  ]
}
```

--------------------------------

### cURL Example for Get Pattern Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-pattern-group

Use this cURL command to make a GET request to retrieve a specific pattern group by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/pattern-groups/28ad21b2-585c-4b68-9fad-b78711078496
```

--------------------------------

### cURL Example for Get Address Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-address-group

Use this cURL command to make a GET request to retrieve a specific address group by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/address-groups/4dc14f3d-ebf8-4032-8a7a-ef9ec6cd3dd2
```

--------------------------------

### cURL Example for Submitting Explanation

Source: https://docs.logpresso.com/en/sonar/5.0/api/submit-explanation

Use this cURL command to submit an employee explanation for a request. Ensure you replace `<API_KEY>` and `HOSTNAME` with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     -H "Content-Type: application/json" \
     -X POST \
     -d '{
       "type": "EXPLANATION",
       "status": "SUBMITTED",
       "result": 0,
       "content": "Performed during the scheduled maintenance window."
     }' \
     https://HOSTNAME/api/sonar/explanation-requests/a1b2c3d4-e5f6-7890-abcd-ef1234567890
```

--------------------------------

### Logpresso Configuration Example

Source: https://docs.logpresso.com/en/query/before-you-start

Example of how to set the allowed file scan paths in the logpresso.conf file. Ensure DATADIR and LOGDIR are uncommented if using variables.

```bash
# Parameter:	-Daraqne.logdb.allowed_file_scan_paths
# Description:	comma-separated local file access allowlist
# Default:	araqne.data.dir/araqne-logdb/scan,araqne.log.dir
# Note:		Be sure to uncomment the DATADIR and the LOGDIR config above when using the variable.
#ALLOWED_FILE_SCAN_PATHS="$DATADIR/araqne-logdb/scan,$LOGDIR"
```

--------------------------------

### cURL Example for Get Table Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-table-group

Use this cURL command to retrieve a table group by its GUID. Replace HOSTNAME with your Sonar instance hostname and <API_KEY> with your authentication token. The :guid parameter should be replaced with the actual table group GUID.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/table-groups/:guid"
```

--------------------------------

### Success Response for Get User Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-user-group

This is an example of a successful response when retrieving user group information. It includes details such as company information, group GUID, name, description, owner, and associated user GUIDs.

```json
{
  "user_group": {
    "company_guid": "6fbe27b7-f1ae-4d7a-a1a5-76d8fa9aa311",
    "company_name": "Logpresso",
    "guid": "28c1251b-2f7c-4c58-95a1-fc4a1ead877e",
    "name": "Cyber Security",
    "description": "",
    "owner_guid": "ffaf431b-653a-4329-8f83-913cbb00342d",
    "owner_name": "Yang",
    "user_guids": ["ffaf431b-653a-4329-8f83-913cbb00342d"],
    "created": "2022-09-01 01:08:00+0900",
    "updated": "2022-09-01 01:08:00+0900"
  }
}
```

--------------------------------

### Insert Records with Automatic Table Creation

Source: https://docs.logpresso.com/en/query/insert-command

This example shows how to use the 'insert' command with the 'create=t' option to automatically create the target table if it does not already exist. If the table does not exist and 'create' is not enabled, records will be skipped or an error will be logged.

```json
[{"_table": "new_table", "src_ip": "192.0.2.1", "action": "allow"}]
```

```logql
| insert table=_table create=t
```

--------------------------------

### cURL Example for Get User-defined Filter

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-user-defined-filter

Use this cURL command to make a GET request to retrieve a specific user-defined filter. Replace HOSTNAME and the GUID with your actual values. Requires an API key with appropriate permissions.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/user-defined-filters/a1b2c3d4-e5f6-7890-abcd-ef1234567890"
```

--------------------------------

### cURL Example for Acknowledge App Install

Source: https://docs.logpresso.com/en/sonar/5.0/api/ack-install-app

Use this cURL command to send the installation status of an app to the Sonar API. Ensure you replace `<API_KEY>` and `HOSTNAME` with your actual credentials and server address.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     -H "Content-Type: application/json" \
     -X POST \
     -d '{"token": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "status": "completed"}' \
     https://HOSTNAME/api/sonar/apps/ack-install
```

--------------------------------

### Get Batch Rule cURL Example

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-batch-rule

Use this cURL command to make a GET request to retrieve a specific batch rule by its GUID. Ensure you replace HOSTNAME with your actual hostname and <API_KEY> with your valid API key.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/batch-rules/f4ca02c8-0679-49e7-8c10-76667c26b595
```

--------------------------------

### cURL Example for Getting Ticket Comments

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-ticket-comments

Use this cURL command to make a GET request to retrieve comments for a specific ticket. Replace `<API_KEY>` and `HOSTNAME` with your actual credentials and server address. The ticket GUID is also a placeholder.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/tickets/49272877-75f2-4c2f-9301-d21c4f9a106c/comments
```

--------------------------------

### Error Response - Install Step Already Proceeded

Source: https://docs.logpresso.com/en/sonar/5.0/api/start-install-app

This error occurs if the installation process has already been initiated for the given token and app symbol.

```json
{
  "error_code": "illegal-state",
  "error_msg": "main install session alreay START_INSTALL_APP : token-[a1b2c3d4-e5f6-7890-abcd-ef1234567890] app symbol-[com.logpresso.sample.app]"
}
```

--------------------------------

### Success Response for Get Report Groups

Source: https://docs.logpresso.com/en/sonar/5.0/api/section-report-api

This is an example of a successful response when retrieving report groups. It includes details such as GUID, name, and owner information for each group.

```json
{
  "report_groups": [
    {
      "guid": "8cdf8f7e-ebc6-4100-88f8-e97297cf5fc2",
      "name": "Report group",
      "description": null,
      "owner_guid": "ce23adf2-13e4-40f9-ad0c-74d090b1f10c",
      "owner_name": "Demo",
      "parent_guid": null,
      "created_at": "2024-08-08 10:28:17+0900",
      "updated_at": "2024-08-08 10:28:17+0900"
    }
  ]
}

```

--------------------------------

### cURL Example for Get Procedure

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-procedure

Use this cURL command to retrieve details of a specific procedure by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/procedures/5ad13151-dbc1-41c0-92a7-dfeb5f534f4c
```

--------------------------------

### Command Format: Options with Target Object

Source: https://docs.logpresso.com/en/query/query-syntax

Demonstrates the correct syntax for commands with target objects, including options in 'key=value' format without spaces around the equals sign.

```logpresso
table duration=1h sys_cpu_logs                 ✅ Option: no spaces
```

```logpresso
table duration = 1h sys_cpu_logs               ❌ Option: spaces not allowed
```

```logpresso
| eval total = kernel + user                   ✅ Assignment: spaces allowed
```

--------------------------------

### Success Response for Get Logger Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-logger-group

This is an example of a successful response when retrieving logger group information. It includes details like GUID, name, and timestamps.

```json
{
  "logger_group": {
    "guid": "0565a218-a78d-43ff-89b6-a9899adcf8c5",
    "name": "Firewall",
    "description": null,
    "parent_guid": null,
    "created": "2023-10-01 22:20:44+0900",
    "updated": "2023-10-01 22:20:44+0900"
  }
}
```

--------------------------------

### First Call Example: List Loggers

Source: https://docs.logpresso.com/en/sonar/5.0/api/section-authentication

This example demonstrates how to list loggers using a cURL command, including the necessary Authorization header and query parameters.

```APIDOC
## First Call Example: List Loggers

### Description
The following cURL command lists loggers.

### Method
GET

### Endpoint
`https://HOSTNAME/api/sonar/loggers`

### Query Parameters
- **offset** (integer) - Optional - The starting offset for the list.
- **limit** (integer) - Optional - The maximum number of items to return.

### Request Example
```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/loggers?offset=0&limit=10"
```
```

--------------------------------

### cURL Example for Get Runtime Parser

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-runtime-parser

Demonstrates how to call the Get Runtime Parser API using cURL to retrieve a parser instance from memory. Ensure you replace `<API_KEY>` and `HOSTNAME` with your actual credentials and server address.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/parsers/syslog-rfc5424/runtime
```

--------------------------------

### cURL Example for Getting a Ticket

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-ticket

Use this cURL command to retrieve details for a specific ticket by its GUID. Ensure you replace HOSTNAME with your Sonar instance's hostname and <API_KEY> with your valid API key. The ticket GUID is a required parameter.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/tickets/49272877-75f2-4c2f-9301-d21c4f9a106d
```

--------------------------------

### Run Scheduled Queries (cURL Example)

Source: https://docs.logpresso.com/en/sonar/5.0/api/run-scheduled-queries

Example of how to run specified scheduled queries using cURL. Administrator privileges are required.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     -d guids="GUID1,GUID2,GUIDN" \
     -X POST https://HOSTNAME/api/sonar/scheduled-queries/run
```

--------------------------------

### cURL Example for Get Connect Profile

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-connect-profile

Use this cURL command to retrieve the details of a specific connect profile by its GUID. Replace HOSTNAME and API_KEY with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/connect-profiles/b7f00412-8720-4a8f-ac35-7d7f359f797e
```

--------------------------------

### cURL Example for Get Subnet Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-subnet-group

Use this cURL command to retrieve details of a specific subnet group by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/subnet-groups/bb994ca4-1471-4b91-89f2-99a61bd529b5
```

--------------------------------

### cURL Example for Creating Download Token

Source: https://docs.logpresso.com/en/sonar/5.0/api/create-query-result-token

Use this cURL command to request a download token for query results. Ensure you replace placeholders like <API_KEY> and HOSTNAME with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
    -d "filename=my_query.csv" \
    -X POST "https://HOSTNAME/api/sonar/cursors/1234/download-token"
```

--------------------------------

### cURL Example to Get Logger Model

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-logger-model

Use this cURL command to retrieve information about a specific logger model by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/logger-models/cd09ae6f-fbc3-11ed-9320-02d178f999a6
```

--------------------------------

### cURL Example for Get Tables

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-tables

Demonstrates how to call the Get Tables API using cURL. Ensure you replace <API_KEY> and HOSTNAME with your actual credentials and server address.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/tables
```

--------------------------------

### cURL Example for Get Logger Group

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-logger-group

Use this cURL command to retrieve details of a specific logger group by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/logger-groups/0565a218-a78d-43ff-89b6-a9899adcf8c5
```

--------------------------------

### Success Response Example

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-global-configs

This is an example of a successful response when retrieving global configurations. Sensitive keys such as SMTP password and LDAP bind password are shown as '********'.

```json
{
  "global_configs": {
    "smtp_host": "smtp.example.com",
    "smtp_port": "25",
    "smtp_pass": "********",
    "ldap_host": "ldap.example.com",
    "ldap_bind_password": "********",
    "min_password_len": "8",
    "max_password_len": "64"
  }
}
```

--------------------------------

### cURL Example for Get Lifecycle Profile

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-lifecycle-profile

Use this cURL command to retrieve a lifecycle profile by its GUID. Replace HOSTNAME and <API_KEY> with your actual values. Requires administrator role.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/lifecycle-profiles/:guid"
```

--------------------------------

### Clone Logpresso App Examples Repository

Source: https://docs.logpresso.com/en/app-sdk/download-sample-app

Use this command to clone the sample application repository from GitHub. This repository contains examples for developing Logpresso apps.

```bash
git clone git@github.com:logpresso/logpresso-app-examples.git

```

--------------------------------

### cURL Example for Get AI Prompt

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-ai-prompt

Use this cURL command to retrieve the details of a specific AI prompt by its GUID. Ensure you replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/ai/prompts/a1b2c3d4-e5f6-7890-abcd-ef1234567890
```

--------------------------------

### Command Example: Querying System Table

Source: https://docs.logpresso.com/en/query/query-syntax

A basic command to query data from the 'araqne_query_logs' system table.

```logpresso
table araqne_query_logs
```

--------------------------------

### cURL Example for Uninstalling an App

Source: https://docs.logpresso.com/en/sonar/5.0/api/uninstall-app

Use this cURL command to send a POST request to the uninstall API. Ensure you replace `<API_KEY>` with your actual API key and adjust the `app_code` and `all_objects` parameters as needed.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     -H "Content-Type: application/json" \
     -X POST \
     -d '{"app_code": "logpresso-sample-app", "all_objects": false}' \
     https://HOSTNAME/api/sonar/apps/uninstall
```

--------------------------------

### Retrieve All Running Batch Detection Scenarios

Source: https://docs.logpresso.com/en/query/sonar-running-batch-rules-command

Use this command to get the GUID, name, submission time, start time, and query ID of all batch detection scenarios currently executing.

```bash
sonar-running-batch-rules
```

--------------------------------

### Retrieve Running Batch Detection Scenarios

Source: https://docs.logpresso.com/en/query/section-sonar-batch-rules

Use this command to get the GUID, name, submission time, start time, and query ID of all batch detection scenarios that are currently running.

```bash
sonar-running-batch-rules

```

--------------------------------

### App Installation Success Response

Source: https://docs.logpresso.com/en/sonar/5.0/api/start-install-app

This is the expected success response when the app package is valid and installation proceeds.

```json
{
  "installable_status": {
    "is_valid": true,
    "reason": null
  }
}
```

--------------------------------

### Expand Array Fields and Aggregate

Source: https://docs.logpresso.com/en/query/explode-command

This example demonstrates how to split a string of IP addresses into an array, then use 'explode' to create individual records for each IP, and finally aggregate the count of each IP.

```logpresso
json "[{'line': '192.0.2.1 198.51.100.2'}, {'line': '198.51.100.2 203.0.113.3'}]"
| eval ip = split(line, " ")
| explode ip
| stats count by ip
```

--------------------------------

### Success Response for Get Connect Profile Test

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-connect-profile-test

Example of a successful response when retrieving the status of a connect profile test. The response includes the test's GUID and its current state.

```json
{
  "guid": "f2e4c1d3-9b21-4f0a-8de7-5b3a91f8c6a2",
  "status": {
    "guid": "f2e4c1d3-9b21-4f0a-8de7-5b3a91f8c6a2",
    "state": "done"
  }
}
```

--------------------------------

### cURL Example for Identity Provider Configurations

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-identity-provider-factory-configs

Use this cURL command to make a GET request to retrieve the configuration options for a specific identity provider. Replace HOSTNAME and <API_KEY> with your actual values.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/id-providers/saml/configs
```

--------------------------------

### Get User Group cURL Example

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-user-group

Use this cURL command to make a GET request to retrieve a specific user group by its GUID. Ensure you replace HOSTNAME with your actual Sonar instance hostname and <API_KEY> with your valid API key. Requires MEMBER role or higher.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/user-groups/28c1251b-2f7c-4c58-95a1-fc4a1ead877e
```

--------------------------------

### Run Scheduled Queries with Partial Failure (cURL Example)

Source: https://docs.logpresso.com/en/sonar/5.0/api/run-scheduled-queries

Example cURL request demonstrating how to run scheduled queries when some might fail. Includes a list of GUIDs for the queries to run.

```bash
curl -k -H "Authorization: Bearer API_KEY" \
     -d guids="0ff16aa8-dbc1-458a-9769-342de5cf9219,65c6c0d3-b8a4-49b3-b4ea-ddd0e321c221,b7007eb2-c1df-4d4d-84f1-5d0af91db25d" \
     -X POST https://HOSTNAME/api/sonar/scheduled-queries/run
```

--------------------------------

### Success Response for Get Lookup Schemas

Source: https://docs.logpresso.com/en/sonar/5.0/api/section-lookup-api

This is an example of a successful response when retrieving lookup schemas. It includes the total count and a list of lookup details, such as GUID, name, description, and field definitions.

```json
{
  "total_count": 17,
  "lookups": [
    {
      "guid": "76b8699d-91a1-4576-a908-7db753570a0a",
      "name": "country_code",
      "description": "Country code to Korean name mapping",
      "record_count": 236,
      "fields": [
        {
          "field_name": "country",
          "len": 2,
          "use_null": false
        },
        {
          "field_name": "name",
          "len": 255,
          "use_null": false
        }
      ],
      "created": "2023-09-23 17:13:15+0900",
      "updated": "2023-09-23 17:13:15+0900"
    }
  ]
}

```

--------------------------------

### Get Stream Rule cURL Example

Source: https://docs.logpresso.com/en/sonar/5.0/api/get-stream-rule

Use this cURL command to retrieve details of a specific stream rule by its GUID. Ensure you replace `<API_KEY>` and `HOSTNAME` with your actual credentials and server address.

```bash
curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/stream-rules/3b05608f-8dd0-4218-9d6d-391515b6280d
```
Tokens:
Raw