Search
The Search APIs help you to search through the log data collected from your agents. The search query can be formed with the help of Meta Data APIs.
Simple Search
The Simple Search API can be used to perform searches over a smaller data range. The user can create a search request with the set of relevant metadata.
The server executes the request and responds with results directly. Simple Search can be used to search over the first 500000 logs.
Rate limit: 50 requests per minute per organization.
OAuth Scope : logs360cloud.search.READ
Arguments
The value must be ≥ 1970-01-01T00:00:00Z. Time zone offsets are supported.
The value must be ≥ 1970-01-01T00:00:00Z. Time zone offsets are supported.
Maximum: 100 host IDs
Maximum: 100 log types
Maximum: 100 group IDs
Default value: 1
Default value: 10
Maximum: 1000
Default value: server
Accepted values: client, server
Headers
parameters_data='{"field1":"value1","field2":"value2"}';
headers_data = Map();
headers_data.put("account_id", "18XXXXX4");
headers_data.put("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f");
response = invokeUrl
[
url: "https://log360cloud.manageengine.com/api/v2/search"
type: POST
headers: headers_data
content-type: application/json
parameters: parameters_data
connection: <connection_name>
];
info response;
OkHttpClient client = new OkHttpClient();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"field1\":\"value1\",\"field2\":\"value2\"}");
Request request = new Request.Builder()
.url("https://log360cloud.manageengine.com/api/v2/search")
.post(body)
.addHeader("account_id", "18XXXXX4")
.addHeader("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f")
.addHeader("content-type", "application/json")
.build();
Response response = client.newCall(request).execute();
const options = {
method: 'POST',
headers: {
account_id: '18XXXXX4',
Authorization: 'Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f',
'content-type': 'application/json'
},
body: '{"field1":"value1","field2":"value2"}'
};
fetch('https://log360cloud.manageengine.com/api/v2/search', options)
.then(response => response.json())
.then(response => console.log(response))
.catch(err => console.error(err));
import http.client
conn = http.client.HTTPSConnection("log360cloud.manageengine.com")
payload = "{\"field1\":\"value1\",\"field2\":\"value2\"}"
headers = {
'account_id': "18XXXXX4",
'Authorization': "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f",
'content-type': "application/json"
}
conn.request("POST", "/api/v2/search", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
const http = require("https");
const options = {
"method": "POST",
"hostname": "log360cloud.manageengine.com",
"port": null,
"path": "/api/v2/search",
"headers": {
"account_id": "18XXXXX4",
"Authorization": "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f",
"content-type": "application/json"
}
};
const req = http.request(options, function (res) {
const chunks = [];
res.on("data", function (chunk) {
chunks.push(chunk);
});
res.on("end", function () {
const body = Buffer.concat(chunks);
console.log(body.toString());
});
});
req.write(JSON.stringify({field1: 'value1', field2: 'value2'}));
req.end();
curl --request POST \
--url https://log360cloud.manageengine.com/api/v2/search \
--header 'Authorization: Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f' \
--header 'account_id: 18XXXXX4' \
--header 'content-type: application/json' \
--data '{"field1":"value1","field2":"value2"}'
{
"query": " ( ( severity = \"success\" AND type = \"Security\" ) )",
"start_time": "2025-03-27T14:30:00Z",
"end_time": "2025-03-28T14:30:00Z",
"log_source_ids": [
30000000251315,
6000000286357
],
"log_types": [
"Windows",
"Unix"
],
"log_source_group_ids": [
3000000012292,
6000000013071
],
"from": 1,
"limit": 1000,
"response_type": "client"
}
{
"data": {
"hits": {
"rows": [
{
"AccountId": "153935663359",
"Event Version": "1.09",
"Source": "ela-automation",
"IP Address": "136.143.177.61",
"Event Source": "cloudtrail.amazonaws.com",
"LogType": "aws cloudtrail",
"Severity": "information",
"Time": "2024-01-04 19:04:37",
"Event Type": "awsapicall",
"Error Message": "-",
"User Agent": "aws-sdk-java/1.11.762 linux/3.10.0-957.21.3.el7.x86_64 openjdk_64-bit_server_vm/11.0.21+9-lts java/11.0.21 groovy/4.0.12 vendor/azul_systems,_inc.",
"Event Category": "management"
}
]
}
},
"meta": {
"total_items": 278973
}
}
{
"error": {
"code": "00000101",
"title": "Unauthorized",
"detail": "Invalid OAuth Token"
}
}
{
"error": {
"code": "10001001",
"title": "Internal Server Error",
"detail": "An unexpected error occurred while processing the request. Please try again later."
}
}
Bulk Search
The Bulk Search API can be used to perform searches over a larger data range. The user can create a search request with the set of relevant metadata.
The server executes the request, paginates the data to 5000 records per page and returns with the request ID and total page count. The user can use the request ID to fetch the records of a specified page.
Rate limit: 50 requests per minute per organization.
OAuth Scope : logs360cloud.search.READ
Arguments
The value must be ≥ 1970-01-01T00:00:00Z. Time zone offsets are supported.
The value must be ≥ 1970-01-01T00:00:00Z. Time zone offsets are supported.
Maximum: 100 host IDs
Maximum: 100 log types
Maximum: 100 group IDs
Headers
parameters_data='{"field1":"value1","field2":"value2"}';
headers_data = Map();
headers_data.put("account_id", "18XXXXX4");
headers_data.put("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f");
response = invokeUrl
[
url: "https://log360cloud.manageengine.com/api/v2/search/bulk"
type: POST
headers: headers_data
content-type: application/json
parameters: parameters_data
connection: <connection_name>
];
info response;
OkHttpClient client = new OkHttpClient();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"field1\":\"value1\",\"field2\":\"value2\"}");
Request request = new Request.Builder()
.url("https://log360cloud.manageengine.com/api/v2/search/bulk")
.post(body)
.addHeader("account_id", "18XXXXX4")
.addHeader("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f")
.addHeader("content-type", "application/json")
.build();
Response response = client.newCall(request).execute();
const options = {
method: 'POST',
headers: {
account_id: '18XXXXX4',
Authorization: 'Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f',
'content-type': 'application/json'
},
body: '{"field1":"value1","field2":"value2"}'
};
fetch('https://log360cloud.manageengine.com/api/v2/search/bulk', options)
.then(response => response.json())
.then(response => console.log(response))
.catch(err => console.error(err));
import http.client
conn = http.client.HTTPSConnection("log360cloud.manageengine.com")
payload = "{\"field1\":\"value1\",\"field2\":\"value2\"}"
headers = {
'account_id': "18XXXXX4",
'Authorization': "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f",
'content-type': "application/json"
}
conn.request("POST", "/api/v2/search/bulk", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
const http = require("https");
const options = {
"method": "POST",
"hostname": "log360cloud.manageengine.com",
"port": null,
"path": "/api/v2/search/bulk",
"headers": {
"account_id": "18XXXXX4",
"Authorization": "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f",
"content-type": "application/json"
}
};
const req = http.request(options, function (res) {
const chunks = [];
res.on("data", function (chunk) {
chunks.push(chunk);
});
res.on("end", function () {
const body = Buffer.concat(chunks);
console.log(body.toString());
});
});
req.write(JSON.stringify({field1: 'value1', field2: 'value2'}));
req.end();
curl --request POST \
--url https://log360cloud.manageengine.com/api/v2/search/bulk \
--header 'Authorization: Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f' \
--header 'account_id: 18XXXXX4' \
--header 'content-type: application/json' \
--data '{"field1":"value1","field2":"value2"}'
{
"query": " ( ( severity = \"success\" AND type = \"Security\" ) )",
"start_time": "2025-03-27T14:30:00Z",
"end_time": "2025-03-28T14:30:00Z",
"log_source_ids": [
30000000251315,
6000000286357
],
"log_types": [
"Windows",
"Unix"
],
"log_source_group_ids": [
3000000012292,
6000000013071
]
}
{
"data": {
"request_id": 1799008983883
},
"meta": {
"total_pages": 40
}
}
{
"error": {
"code": "00000101",
"title": "Unauthorized",
"detail": "Invalid OAuth Token"
}
}
{
"error": {
"code": "10001001",
"title": "Internal Server Error",
"detail": "An unexpected error occurred while processing the request. Please try again later."
}
}
Bulk Search Result
To Fetch the search response of a specific page.
OAuth Scope : logs360cloud.search.READ
Query Parameters
Default value: server
Accepted values: client, server
Headers
headers_data = Map();
headers_data.put("account_id", "18XXXXX4");
headers_data.put("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f");
response = invokeUrl
[
url: "https://log360cloud.manageengine.com/api/v2/search/bulk?request_id=1799008983883&page=1"
type: GET
headers: headers_data
connection: <connection_name>
];
info response;
OkHttpClient client = new OkHttpClient();
Request request = new Request.Builder()
.url("https://log360cloud.manageengine.com/api/v2/search/bulk?request_id=1799008983883&page=1")
.get()
.addHeader("account_id", "18XXXXX4")
.addHeader("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f")
.build();
Response response = client.newCall(request).execute();
const options = {
method: 'GET',
headers: {
account_id: '18XXXXX4',
Authorization: 'Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f'
}
};
fetch('https://log360cloud.manageengine.com/api/v2/search/bulk?request_id=1799008983883&page=1', options)
.then(response => response.json())
.then(response => console.log(response))
.catch(err => console.error(err));
import http.client
conn = http.client.HTTPSConnection("log360cloud.manageengine.com")
headers = {
'account_id': "18XXXXX4",
'Authorization': "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f"
}
conn.request("GET", "/api/v2/search/bulk?request_id=1799008983883&page=1", headers=headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
const http = require("https");
const options = {
"method": "GET",
"hostname": "log360cloud.manageengine.com",
"port": null,
"path": "/api/v2/search/bulk?request_id=1799008983883&page=1",
"headers": {
"account_id": "18XXXXX4",
"Authorization": "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f"
}
};
const req = http.request(options, function (res) {
const chunks = [];
res.on("data", function (chunk) {
chunks.push(chunk);
});
res.on("end", function () {
const body = Buffer.concat(chunks);
console.log(body.toString());
});
});
req.end();
curl --request GET \
--url 'https://log360cloud.manageengine.com/api/v2/search/bulk?request_id=1799008983883&page=1' \
--header 'Authorization: Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f' \
--header 'account_id: 18XXXXX4'
{
"data": {
"hits": {
"rows": [
{
"AccountId": "153935663359",
"Event Version": "1.09",
"Source": "ela-automation",
"IP Address": "136.143.177.61",
"Event Source": "cloudtrail.amazonaws.com",
"LogType": "aws cloudtrail",
"Severity": "information",
"Time": "2024-01-04 19:04:37",
"Event Type": "awsapicall",
"Error Message": "-",
"User Agent": "aws-sdk-java/1.11.762 linux/3.10.0-957.21.3.el7.x86_64 openjdk_64-bit_server_vm/11.0.21+9-lts java/11.0.21 groovy/4.0.12 vendor/azul_systems,_inc.",
"Event Category": "management"
}
]
}
},
"meta": {
"items_range_in_current_page": "5001-10000",
"total_items": "5000"
}
}
{
"error": {
"code": "00000101",
"title": "Unauthorized",
"detail": "Invalid OAuth Token"
}
}
{
"error": {
"code": "10001001",
"title": "Internal Server Error",
"detail": "An unexpected error occurred while processing the request. Please try again later."
}
}
Aggregated Search
Retrieves aggregated search results for the specified query, grouped by up to three specified group_by fields with aggregation functions such as COUNT, COUNT_DISTINCT, SUM, AVG, MIN, MAX, FIRST, or LAST applied, with a default limit of 1,000 buckets per group_by field. Use this endpoint to retrieve summarized log data, such as when building dashboards, or generating trend analysis.
Rate limit: 15 requests per minute per organization.
OAuth Scope : logs360cloud.search.READ
Arguments
The value must be ≥ 1970-01-01T00:00:00Z. Time zone offsets are supported.
The value must be ≥ 1970-01-01T00:00:00Z. Time zone offsets are supported.
Maximum: 100 host IDs
Maximum: 100 group IDs
Maximum: 100 log types
Default value: 1000
Maximum: 1000
_count to sort by event count, or specify a field name from group_by or aggregation_fields.Accepted values:
asc (ascending), desc (descending)Default value: desc
SUM – Sum of all numeric values of the field in each group.
AVG – Average of all numeric values of the field in each group.
MIN – Minimum value of the field in each group.
MAX – Maximum value of the field in each group.
FIRST – Value of the field from the earliest event (by time) in each group.
LAST – Value of the field from the most recent event (by time) in each group.
COUNT – Total number of events in each group.
COUNT_DISTINCT – Number of unique values of the field in each group.
Headers
parameters_data='{"field1":"value1","field2":"value2"}';
headers_data = Map();
headers_data.put("account_id", "18XXXXX4");
headers_data.put("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f");
response = invokeUrl
[
url: "https://log360cloud.manageengine.com/api/v2/search/aggregate"
type: POST
headers: headers_data
content-type: application/json
parameters: parameters_data
connection: <connection_name>
];
info response;
OkHttpClient client = new OkHttpClient();
MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\"field1\":\"value1\",\"field2\":\"value2\"}");
Request request = new Request.Builder()
.url("https://log360cloud.manageengine.com/api/v2/search/aggregate")
.post(body)
.addHeader("account_id", "18XXXXX4")
.addHeader("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f")
.addHeader("content-type", "application/json")
.build();
Response response = client.newCall(request).execute();
const options = {
method: 'POST',
headers: {
account_id: '18XXXXX4',
Authorization: 'Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f',
'content-type': 'application/json'
},
body: '{"field1":"value1","field2":"value2"}'
};
fetch('https://log360cloud.manageengine.com/api/v2/search/aggregate', options)
.then(response => response.json())
.then(response => console.log(response))
.catch(err => console.error(err));
import http.client
conn = http.client.HTTPSConnection("log360cloud.manageengine.com")
payload = "{\"field1\":\"value1\",\"field2\":\"value2\"}"
headers = {
'account_id': "18XXXXX4",
'Authorization': "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f",
'content-type': "application/json"
}
conn.request("POST", "/api/v2/search/aggregate", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
const http = require("https");
const options = {
"method": "POST",
"hostname": "log360cloud.manageengine.com",
"port": null,
"path": "/api/v2/search/aggregate",
"headers": {
"account_id": "18XXXXX4",
"Authorization": "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f",
"content-type": "application/json"
}
};
const req = http.request(options, function (res) {
const chunks = [];
res.on("data", function (chunk) {
chunks.push(chunk);
});
res.on("end", function () {
const body = Buffer.concat(chunks);
console.log(body.toString());
});
});
req.write(JSON.stringify({field1: 'value1', field2: 'value2'}));
req.end();
curl --request POST \
--url https://log360cloud.manageengine.com/api/v2/search/aggregate \
--header 'Authorization: Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f' \
--header 'account_id: 18XXXXX4' \
--header 'content-type: application/json' \
--data '{"field1":"value1","field2":"value2"}'
{
"query": " ( ( severity = \"success\" AND type = \"Security\" ) )",
"start_time": "2025-03-27T14:30:00Z",
"end_time": "2025-03-28T14:30:00Z",
"log_source_ids": [
30000000251315,
6000000286357
],
"log_source_group_ids": [
3000000012292,
6000000013071
],
"log_types": [
"Windows",
"Unix"
],
"group_by": [
{
"field_name": "username",
"limit": 10,
"sort": {
"field": "_count",
"order": "desc"
}
}
],
"aggregation_fields": [
{
"field_name": "sent_bytes_i",
"agg_type": "SUM"
}
]
}
{
"data": {
"aggregations": [
{
"key": "username",
"count": 3000,
"values": [
{
"key": "admin",
"count": 523,
"sum(sent_bytes_i)": 1048576
},
{
"key": "root",
"count": 218,
"sum(sent_bytes_i)": 524288
}
]
}
]
},
"meta": {
"total_items": 3000
}
}
{
"error": {
"code": "10010001",
"title": "Bad Request",
"detail": "Invalid parameters : group_by field 'invalid_field' is not a valid field"
}
}
{
"error": {
"code": "00000101",
"title": "Unauthorized",
"detail": "Invalid OAuth Token"
}
}
{
"error": {
"code": "10001029",
"title": "Too Many Requests",
"detail": "API rate limit exceeded. Please retry after some time."
}
}
{
"error": {
"code": "10001001",
"title": "Internal Server Error",
"detail": "An unexpected error occurred while processing the request. Please try again later."
}
}