Indexes

Indexes are the containers your ingested log events live in, referenced by @index / @index_id in queries. You can list and read indexes with the Scanner API.

The API exposes a read-only view of your indexes — the named containers your ingested log events live in, referenced by @index / @index_id in queries. Only user-created indexes are returned; internal system indexes (e.g. detection, audit, usage) are not addressable through this API.

List indexes

GET /v1/index

List the searchable indexes for a tenant.

Query parameters

Name	Type	Description
tenant_id required	string	Unique identifier for the tenant
pagination[page_size]	number	Maximum number of results to return in a page. Defaults to 100.
pagination[page_token]	string	Cursor for pagination. Pass back the next_page_token returned in a previous response's pagination. If omitted, paging starts at the beginning of the list.

Example

curl -G $API_BASE/v1/index \
--data-urlencode "tenant_id=$TENANT_ID" \
--data-urlencode "pagination[page_size]=100" \
-H "Authorization: Bearer $API_KEY"

Response

Returns a paginated envelope whose data.indexes is a list of index objects. The pagination object carries the next_page_token to pass as the next request's pagination[page_token]; next_page_token is null when there are no more pages.

{
  "data": {
    "indexes": [
      {
        "id": "00000000-0000-0000-0000-000000000001",
        "name": "cloudtrail_logs",
        "description": "AWS CloudTrail events"
      }
    ]
  },
  "pagination": {
    "next_page_token": null
  }
}

Get an index

GET /v1/index/{id}

Retrieve a single index by id. Returns 404 for ids that resolve to a non-user index (e.g. detection, audit, usage, or legacy query-record indexes), so internal indexes are not addressable through the public API.

Path parameters

Name	Type	Description
id required	string	Unique index id

Example

curl $API_BASE/v1/index/00000000-0000-0000-0000-000000000001 \
-H "Authorization: Bearer $API_KEY"

Response

Returns the index object.

{
  "id": "00000000-0000-0000-0000-000000000001",
  "name": "cloudtrail_logs",
  "description": "AWS CloudTrail events"
}

Response object reference

Index

Field	Type	Description
id	string	Unique index id. Use as @index_id in queries.
name	string	Index name. Use as @index in queries.
description	string	Human-readable description of the index.