Update Logger model

Updates a specified logger model. Administrator privileges are required to call this API.

HTTP Request

PUT /api/sonar/logger-models/:guid
Request using cURL
curl -H "Authorization: Bearer <API_KEY>" \
     -d name="NGINX" \
     -d description="Demo" \
     -d 'rules=[{"name": "Web log", "log_schema_code": "web", "stream_query": "rex field=line \"(?<src_ip>\\S+) \\S+ \\S+ \\[(?<event_time>\\S+ \\S+)\\] \\\"\\S+ \\S+ \\S+\\\" (?<status>\\d+) (?<sc_bytes>\\d+) \\S+ \\\"(?<user_agent>[^\\\"]+)\" | eval event_time = date(event_time, \"dd/MMM/yyyy:HH:mm:ss Z\"), src_ip = ip(src_ip), sc_bytes = long(sc_bytes)", "stream_interval": 0}]' \
     -X PUT https://HOSTNAME/api/sonar/logger-models
Request Parameters
KeyRequiredTypeDescriptionNote
guidXStringLogger model identifier36-characters GUID. If not specified, randomly generated.
nameOStringLogger model nameMinimum 1 to maximum 50 characters.
descriptionXStringLogger model descriptionMaximum 2,000 characters
parser_codeXStringParser identifier
rulesXObject arrayList of normalization rulesSee rules attributes below

`rules`` attributes

  • (String) guid: Normalization rule identifier. If not specified, randomly generated.
  • (String) name: Normalization rule name
  • (String) log_schema_code: Log schema identifier
  • (String) stream_query: Stream query string
  • (32-bit integer) stream_interval: Stream query refresh interval

Success Response

{}

Error Responses

Required argument is missing

HTTP status code 400

{
  "error_code": "null-argument",
  "error_msg": "name should be not null"
}
Invalid argument length

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'name' must be less than or equal to 50 characters."
}
Parser is not found

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "parser not found: nginx"
}
Duplicated logger model name

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "duplicated logger model name: NGINX"
}
No administrator privileges

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "no-permission"
}