Update Log Schema

Updates an existing log schema.

Required Permissions

Requires the ADMIN role or higher.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     -d name="Ping" \
     -d fields="[{""name"":""_time"", ""type"":""DATE"", ""display_name"":""Time"", ""ordinal"":1}, {""name"":""src_ip"", ""type"":""IP"", ""display_name"":""SourceIP"", ""ordinal"":2}, {""name"":""dst_ip"", ""type"":""IP"", ""display_name"":""DestinationIP"", ""ordinal"":3},{""name"":""rtt"", ""type"":""INT"", ""display_name"":""RoundTripTime"", ""ordinal"":4}]" \
     -X PUT \
     https://HOSTNAME/api/sonar/log-schemas/ping

Request Parameters

name_trans is a JSON object string that contains schema names for each locale:

• ko (String, Optional): Korean name
• en (String, Optional): English name
• zh (String, Optional): Chinese name

fields is a JSON array string where each object contains the following properties:

• name (String, Required): Field name (Minimum 1 to maximum 50 characters)
• display_name (String, Required): Display name (Minimum 1 to maximum 50 characters)
• display_name_trans (Object, Optional): Display name for each locale
• type (String, Required): Field type
  • One of the following: DATE, STRING, IP, PORT, SHORT, INT, LONG, COUNTRY, FLOAT, DOUBLE, BOOL, MD5, SHA1, URL, SHA256, DOMAIN
• ordinal (32-bit integer, Optional): Field order

Success Response

HTTP status code 200

{
  "code": "ping"
}

Error Responses

No privilege to update a log schema

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "no-permission"
}

Required argument is missing

HTTP status code 400

{
  "error_code": "null-argument",
  "error_msg": "'code' should be not null"
}

Invalid argument length

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'code' must be shorter than or equal to 50 characters."
}

Log schema not found

HTTP status code 500

{
  "error_code": "illegal-state",
  "error_msg": "log schema not found: test"
}

Field validation errors

HTTP status code 400

Field name is missing:

{
  "error_code": "null-argument",
  "error_msg": "'fields.name' should be not null"
}

Field display name is missing:

{
  "error_code": "null-argument",
  "error_msg": "'fields.display_name' should be not null"
}

Invalid field type:

{
  "error_code": "invalid-argument",
  "error_msg": "'fields.type' should be one of DATE, STRING, IP, PORT, SHORT, INT, LONG, COUNTRY, FLOAT, DOUBLE, BOOL, MD5, SHA1, URL, SHA256, DOMAIN"
}