Get log schema

Retrieves data structure for a specified log schema.

Required Permissions

Requires the MEMBER role or higher.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/log-schemas/session

Request Parameters

Success Response

Below is an example of retrieving the session log schema. The product ships base schemas in Korean regardless of the installation or console language, so name, description, and display_name come back in Korean. Schemas with registered translations also return name_trans and display_name_trans.

{
  "schema": {
    "code": "session",
    "name": "세션",
    "description": "방화벽 세션 및 네트워크 플로우",
    "created": "2022-09-01 00:31:13+0900",
    "updated": "2022-09-01 00:31:13+0900",
    "fields": [
      {
        "name": "_time",
        "display_name": "시각",
        "type": "DATE",
        "ordinal": 1
      },
      {
        "name": "src_ip",
        "display_name": "출발지IP",
        "type": "IP",
        "ordinal": 2
      },
      {
        "name": "src_port",
        "display_name": "출발지포트",
        "type": "PORT",
        "ordinal": 3
      },
      {
        "name": "dst_ip",
        "display_name": "목적지IP",
        "type": "IP",
        "ordinal": 4
      },
      {
        "name": "dst_port",
        "display_name": "목적지포트",
        "type": "PORT",
        "ordinal": 5
      },
      {
        "name": "protocol",
        "display_name": "프로토콜",
        "type": "STRING",
        "ordinal": 6
      },
      {
        "name": "app",
        "display_name": "응용",
        "type": "STRING",
        "ordinal": 7
      },
      {
        "name": "action",
        "display_name": "대응",
        "type": "STRING",
        "ordinal": 8
      },
      {
        "name": "nat_src_ip",
        "display_name": "NAT출발지IP",
        "type": "IP",
        "ordinal": 9
      },
      {
        "name": "nat_src_port",
        "display_name": "NAT출발지포트",
        "type": "PORT",
        "ordinal": 10
      },
      {
        "name": "nat_dst_ip",
        "display_name": "NAT목적지IP",
        "type": "IP",
        "ordinal": 11
      },
      {
        "name": "nat_dst_port",
        "display_name": "NAT목적지포트",
        "type": "PORT",
        "ordinal": 12
      },
      {
        "name": "policy",
        "display_name": "정책",
        "type": "STRING",
        "ordinal": 13
      },
      {
        "name": "duration",
        "display_name": "접속시간",
        "type": "LONG",
        "ordinal": 14
      },
      {
        "name": "total_bytes",
        "display_name": "바이트",
        "type": "STRING",
        "ordinal": 15
      },
      {
        "name": "total_pkts",
        "display_name": "패킷",
        "type": "STRING",
        "ordinal": 16
      },
      {
        "name": "sent_pkts",
        "display_name": "송신패킷",
        "type": "LONG",
        "ordinal": 17
      },
      {
        "name": "rcvd_pkts",
        "display_name": "수신패킷",
        "type": "LONG",
        "ordinal": 18
      },
      {
        "name": "sent_bytes",
        "display_name": "송신바이트",
        "type": "LONG",
        "ordinal": 19
      },
      {
        "name": "rcvd_bytes",
        "display_name": "수신바이트",
        "type": "LONG",
        "ordinal": 20
      },
      {
        "name": "src_country",
        "display_name": "출발지국가",
        "type": "COUNTRY",
        "ordinal": 21
      },
      {
        "name": "dst_country",
        "display_name": "목적지국가",
        "type": "COUNTRY",
        "ordinal": 22
      }
    ],
    "app_code": null,
    "app_built_in": null
  }
}

• schema (Map): Log schema definition
  • code (String): Code
  • name (String): Name
  • name_trans (Map): Name translations by locale (ko, en, ja, zh). Returned only when translations are registered
  • description (String): Description
  • created (String): Date and time of creation (yyyy-MM-dd HH:mm:ssZ)
  • updated (String): Date and time of modification (yyyy-MM-dd HH:mm:ssZ)
  • fields (Array): List of normalized field definitions
    • name (String): Field name
    • display_name (String): Display name
    • display_name_trans (Map): Display name translations by locale. Returned only when translations are registered
    • type (String): Type. One of the following: DATE, STRING, IP, PORT, SHORT, INT, LONG, FLOAT, DOUBLE, BOOL, COUNTRY, MD5, SHA1, SHA256, URL, DOMAIN.
    • ordinal (32-bit integer): Field display order
  • app_code (String): App identifier
  • app_built_in (Boolean): Whether it's a built-in app object

Error Responses

Log schema is not found

HTTP status code 200

{
  "schema": null
}