Identifying logs that are not ingested programatically

[benjamin_johnso]

In a host screen, we can see logs that have been detected but are not ingested:

How can these be listed via an API call?

I have looked at the data returned from the entity API for this host & also for the process_group (& process_group_instance) and the data isn't in those models.

[AntonPineiro]

Hi,

Logs are discovered automatically but if you want to ingest then, you need to create logs ingestion rules.

It means, you can check your rules in tenant, host groups or host to know.

It can be checked from API.

Best regards

[benjamin_johnso]

Thanks - I know that we need to create ingestion rules. We have developed self-service functionality where users can configure this themselves via code.

However - if the log is not detected, it requires a "custom log source". I can't see an easy way to determine if a custom log source rule is needed for a specified log path, via an API.

[Yosi_Neuman]

Hi @benjamin_johnso 

Check the response of /api/v2/entities/{entity-id} with process instance id and look  for logFileStatus or logSourceState values. If its not appears try to extend the api timeframe.

HTH

Yos