VK8s Audit Log Query.
const url = 'https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/vk8s_audit_logs';const options = { method: 'POST', headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'}, body: '{"aggs":{},"end_time":"example","limit":1,"namespace":"example","query":"example","scroll":true,"sort":"DESCENDING","start_time":"example","search_after":true,"sort_values":{"last_doc_id":"example","last_timestamp":1}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/vk8s_audit_logs \ --header 'Authorization: <Authorization>' \ --header 'Content-Type: application/json' \ --data '{ "aggs": {}, "end_time": "example", "limit": 1, "namespace": "example", "query": "example", "scroll": true, "sort": "DESCENDING", "start_time": "example", "search_after": true, "sort_values": { "last_doc_id": "example", "last_timestamp": 1 } }'Request to GET Virtual K8s audit logs that matches the criteria in request for a given namespace.
If no match conditions are specified in the request, then the response contains all
CRUD operations performed in the namespace. User with access to the system namespace
may query for audit logs across all namespaces for a given tenant.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Namespace fetch vK8s audit logs for a given namespace.
Request Bodyrequired
Section titled “Request Bodyrequired”Request to fetch Virtual K8s audit logs.
object
Aggregations provide summary/analytics data over the log response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key’ed by user-defined aggregation name. The response will be key’ed with the same name. Optional.
object
Fetch audit logs whose timestamp <= end_time format: unix_timestamp|RFC 3339
Optional: If not specified, then the end_time will be evaluated to start_time+10m
If start_time is not specified, then the end_time will be evaluated to
Limits the number of logs returned in the response Optional: If not specified, first or last 500 log messages that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.
Fetch vK8s audit logs for a given namespace.
Query is used to specify the list of matchers
syntax for query := {[”|”!”]
= : equal to
!= : not equal to
=~ : regex match
!~ : not regex match
When more than one matcher is specified in the query, then audit logs matching ALL the matchers will be returned in the response.
Example: query={objectref.resource=“deployments”} will return all vK8s audit logs for all deployment objects in the given namespace
Optional: If not specified, all the audit logs matching the given tenant and namespace are returned.
Scroll is used to retrieve large number of log messages (or all log messages) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of logs until there are no more logs left to return. The number of messages in each batch is determined by the limit field. Note: Scroll is used for processing large amount of data and therefore is not intended for real time user request. Optional: default is false.
Fetch audit logs whose timestamp >= start_time format: unix_timestamp|RFC 3339
Optional: If not specified, then the start_time will be evaluated to end_time-10m
If end_time is not specified, then the start_time will be evaluated to
Search After is used to retrieve large number of log messages (or all log messages) that matches the query. If search_after is set to true, the sort_values in the response can be used in the API to fetch the next batch of logs. The number of messages in each batch is determined by the limit field. Note: Search After is used for processing large amount of data and therefore is not intended for real time user request. Optional: default is false.
object
This is a unique UUID generated by elastic search.
Configuration parameter for last timestamp
Responses
Section titled “Responses”A successful response.
Response message for AuditLogRequest/AccessLogRequest/LogScrollRequest.
object
Aggregations provide summary/analytics data over the log response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key’ed with the aggregation name specified in the request.
object
List of log messages that matched the query. Not all log messages that matched the query are returned in the response.
Long Base-64 encoded string which can be used to retrieve next batch of log messages using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF). Note: scroll_id is valid only for 2 minutes. I.e., If one intend to retrieve next batch of the result, then the scroll request should be sent within 2 minutes upon receiving the LogResponse.
Total number of log messages that matched the query.
object
This is a unique UUID generated by elastic search.
Configuration parameter for last timestamp
Examplegenerated
{ "aggs": {}, "logs": [ "example" ], "scroll_id": "example", "total_hits": "example", "last_sort_values": { "last_doc_id": "example", "last_timestamp": 1 }}Returned when operation is not authorized.
Examplegenerated
exampleReturned when there is no permission to access resource.
Examplegenerated
exampleReturned when resource is not found.
Examplegenerated
exampleReturned when operation on resource is conflicting with current value.
Examplegenerated
exampleReturned when operation has been rejected as it is happening too frequently.
Examplegenerated
exampleReturned when server encountered an error in processing API.
Examplegenerated
exampleReturned when service is unavailable temporarily.
Examplegenerated
exampleReturned when server timed out processing request.
Examplegenerated
example