Forum Discussion

srinidhi12's avatar
srinidhi12
Icon for Cirrostratus rankCirrostratus
Dec 20, 2022

Rest API filter using timestamp

Hi All,

I am trying to collect the F5 BIG-IP logs using rest API and using the below endpoint

https://192.168.10.10/mgmt/tm/sys/log/audit/stats?options=range,2022-12-19T22:45:22Z

I want to get the logs which are greater than specific timestamp, is there any option to achieve it.

Also I am trying to do pagination but the response gives only the self link, and not the next link, is there any other option to do paging?

Thanks!

devops
security
  • F5_Design_Engineer's avatar
    F5_Design_Engineer
    Icon for MVP rankMVP
    Dec 21, 2022

    Hi srinidhi12 ,

     

    To displays all log entries from the BIG-IP LTM logs, from a particular timestamp 2022-12-19T22:45:22Z to the most recent  add the keyword --indefinite to your rest api string. Like as follows:

    https://192.168.10.10/mgmt/tm/sys/log/audit/stats?options=range,2022-12-19T22:45:22Z--indefinite

    Note: Same as specifying a single date.

    Note: The requested logs contain all the log rotations for that log type that exist on the BIG-IP system. For example, BIG-IP LTM logs are combined from /var/log/ltm, /var/log/ltm.1, and /var/log/ltm[2-9].gz, if those log rotations exist on the system. Additionally, when specifying options=lines,10, this means the first 10 lines of the oldest logs found for that log type.
    You can refer following kb article for more options:

    K41550738: Viewing BIG-IP log files using the iControl REST API

    https://support.f5.com/csp/article/K41550738


    Kindly test and share your inputs if it works.

    HTH

    • srinidhi12's avatar
      srinidhi12
      Icon for Cirrostratus rankCirrostratus
      Dec 22, 2022

      Hi F5_Design_Engineer 

      Thanks for the details, I have tried this way and I was able to get the data from specific time stamp.

      Also I wanted to get the data which is greater than the time, but now I am getting the data which is greater than or equal to the timestamp. Is there any way to get data which is only greater than the specfic time.

       

      Thanks for the support!