Hello,

Does anyone know the correct POST data format for filtering MT logs? I've come this far: when I send a POST request to /rest/log/print with the JSON data , it responds, but it doesn't filter out the IPsec logs as intended. Instead, it still provides the full log

Someone just asked something similar, this is pretty close to what you're trying to do:
viewtopic.php?t=198974

{"follow":{"where":{"topics":"ipsec"}}}

There are a few catches here.

1. There are no regular expressions so you need to match the entire topic as a string.
e.g. in CLI you can do topics~"ipsec" — however in REST API this won't work, so need to match on the log level part so like in CLI topics="ipsec;info"
2. There no "where" in REST, you need to use the ".query" scheme from the older non-REST API
3. print follow may not be as useful, since it will just wait until the timeout (default 60 seconds) for collect any additional results. It does not spit the data out as it's coming in. Below I show an example with CURL+debug, if you remove the "follow":true part it will return with "where topic" filter applied immediately:

Thank you Amm0! I even saw that post you sent but I still didn't get it working
This does exactly what I need.