Community discussions

MikroTik App
 
JDF
just joined
Topic Author
Posts: 12
Joined: Wed Aug 16, 2023 1:40 pm

REST API log filtering/topics

Wed Aug 30, 2023 6:05 pm

Hello,

Does anyone know the correct POST data format for filtering MT logs? I've come this far: when I send a POST request to /rest/log/print with the JSON data
{"follow":{"where":{"topics":"ipsec"}}}
, it responds, but it doesn't filter out the IPsec logs as intended. Instead, it still provides the full log
 
User avatar
Amm0
Forum Guru
Forum Guru
Posts: 3634
Joined: Sun May 01, 2016 7:12 pm
Location: California

Re: REST API log filtering/topics

Wed Aug 30, 2023 6:10 pm

Someone just asked something similar, this is pretty close to what you're trying to do:
viewtopic.php?t=198974
 
User avatar
Amm0
Forum Guru
Forum Guru
Posts: 3634
Joined: Sun May 01, 2016 7:12 pm
Location: California

Re: REST API log filtering/topics  [SOLVED]

Wed Aug 30, 2023 6:31 pm

{"follow":{"where":{"topics":"ipsec"}}}
There are a few catches here.

1. There are no regular expressions so you need to match the entire topic as a string.
e.g. in CLI you can do topics~"ipsec" — however in REST API this won't work, so need to match on the log level part so like in CLI topics="ipsec;info"
2. There no "where" in REST, you need to use the ".query" scheme from the older non-REST API
3. print follow may not be as useful, since it will just wait until the timeout (default 60 seconds) for collect any additional results. It does not spit the data out as it's coming in. Below I show an example with CURL+debug, if you remove the "follow":true part it will return with "where topic" filter applied immediately:

USER=admin ROUTER=192.168.88.1; curl -l -u $USER -X POST http://$ROUTER/rest/log/print -H "Content-Type: application/json" --data '{ "follow": true, ".query": ["topics=\"ipsec;info\""]}' --trace-ascii /dev/stdout
 
JDF
just joined
Topic Author
Posts: 12
Joined: Wed Aug 16, 2023 1:40 pm

Re: REST API log filtering/topics

Wed Aug 30, 2023 7:22 pm

Thank you Amm0! I even saw that post you sent but I still didn't get it working
This does exactly what I need.
{ ".query": ["topics=\"ipsec;info\""]}

Who is online

Users browsing this forum: No registered users and 3 guests