API docs by Redocly

Log API (1.0.0)

Download OpenAPI specification:Download

Log API exposes log management capabilities: projects, archives, refills, pipelines, processors, log search/export, and resource log mappings (vCDN, vDB, vLB, vStorage). Authentication details are available at https://docs.api.vngcloud.vn/service-docs/accounts-api.html#tag/Authentication

Download Controller

Streams binary artifacts owned by the caller, such as project TLS client certificates.

Download a project certificate

Returns a zip archive containing the TLS client certificate, private key, and CA chain for the given project certificate.

Authorizations:
Authorization
path Parameters
project_id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

cert_id
required
string
Example: 5e0a1ce6-3f88-4f5b-94cc-1f7a4e1b2d33

The identifier of the certificate.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/downloads/certificates/projects/332b3934-2210-450c-9912-7fb6a8d03463/5e0a1ce6-3f88-4f5b-94cc-1f7a4e1b2d33 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

vStorage Bucket Log Mapping Controller

Manages vStorage bucket log mappings. A vStorage bucket log mapping links an individual vStorage bucket to a destination log project that receives the bucket access logs.

Update vStorage bucket log mapping

Updates a vStorage bucket log mapping for the given bucket. Sets the destination log project and toggles the mapping status to ACTIVE or INACTIVE.

Authorizations:
Authorization
path Parameters
bucket-name
required
string
Example: tytv2-bucket

The name of the vStorage bucket whose mapping is being updated.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the bucket access logs.

vstorageProjectId
required
string

The identifier of the parent vStorage project that owns the bucket.

status
required
string^(ACTIVE|INACTIVE)$
Enum: "ACTIVE" "INACTIVE"

The target status of the bucket log mapping. ACTIVE enables the mapping; INACTIVE disables it.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "vstorageProjectId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "status": "ACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "bucketName": "tytv2-bucket",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "regionName": "HCM03",
  • "userId": 53461,
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "vstorageProjectName": "string",
  • "vstorageProjectId": "string"
}

List vStorage bucket log mappings

Returns a paginated list of vStorage bucket log mappings owned by the caller, optionally filtered by free-text query and region.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv2-bucket

Free-text search over the bucket name and related fields.

sortBy
string
Default: "createdAt"
Enum: "createdAt" "updatedAt" "name" "status"
Example: sortBy=createdAt

The field to sort by.

sortOrder
string
Default: "DESC"
Enum: "ASC" "DESC"
Example: sortOrder=DESC

The sort direction.

region-id
string [ 0 .. 50 ] characters
Example: region-id=HCM03

Filter results to mappings whose bucket is deployed in the given region.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/vstorage-bucket-log-mappings?query=tytv2-bucket&sortBy=createdAt&sortOrder=DESC&region-id=HCM03&page=0&size=10' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Processor Group Library Controller

Manages processor group libraries. A processor group library is a reusable, system-provided template that can be duplicated into a pipeline as a new processor group.

List processor group libraries

Returns the list of available processor group library templates. The query parameter performs a free-text search over the library name.

Authorizations:
Authorization
query Parameters
query
string
Example: query=audit

Free-text search over the processor group library name.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/processor-group-libraries?query=audit' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
[
  • {
    }
]

Duplicate a processor group library

Creates a new processor group inside the target pipeline using a library template as the source. The new group inherits processors and parser rules from the library.

Authorizations:
Authorization
Request Body schema: application/json
required
userId
integer <int64>
pipelineId
required
string

The identifier of the pipeline that owns this processor group. Overridden by the path parameter on create.

name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the processor group. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

description
string <= 255 characters ^[A-Za-z\d_.\- ]{0,255}$

The description of the processor group. Must be 0–255 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

required
object (Project)

A project reference. Identifies a source or destination project.

required
object (Project)

A project reference. Identifies a source or destination project.

filter
string <= 1024 characters

The filter expression applied to incoming logs at the group level. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value means no filter.

query
string <= 1024 characters

Alternative filter expression slot. Same DSL as filter.

editorEnable
boolean

Whether the filter editor UI is enabled for this resource.

dropFilter
boolean

Whether logs matching the filter are dropped instead of forwarded. When true, the group acts as an exclusion filter.

queryArr
string <= 1024 characters

The structured form of filter, encoded as a stringified JSON array of {key, operator, value} tokens. Used by the editor UI to render the filter visually.

Array of objects (ProcessorRequest)

The processors to create inside this group, in execution order.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "description": "Audit logs from VKS cluster events",
  • "source": {
    },
  • "destination": {
    },
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "processors": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "status": "PROCESSING",
  • "description": "Audit logs from VKS cluster events",
  • "source": {
    },
  • "destination": {
    },
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "processors": [
    ]
}

Refill Controller

Manages refills. A refill is an asynchronous job that replays archived logs into a project over a chosen time window.

List refills

Returns a paginated list of refills owned by the caller. When project_id is supplied, results are filtered to refills targeting that project.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv

Free-text search over the refill name.

project_id
required
string
Example: project_id=332b3934-2210-450c-9912-7fb6a8d03463

Filter results to refills targeting the given destination project.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/refills?query=tytv&project_id=332b3934-2210-450c-9912-7fb6a8d03463&page=0&size=10' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Create a refill from external storage

Creates a refill that pulls logs from an external S3 or vStorage backend into a project over the given time window. Returns immediately with the refill accepted for asynchronous processing.

Authorizations:
Authorization
Request Body schema: application/json
required
storageType
required
string^(S3)|(V_STORAGE)$
Enum: "S3" "V_STORAGE"

The storage backend type. Determines the expected shape of storageSettings.

storageSettings
required
object

The storage backend connection settings. The shape depends on storageType.
When storageType is S3:

{
  "region": "string",
  "bucket": "string",
  "endpoint": "string",
  "prefix": "string",
  "accessKey": "string",
  "secretKey": "string",
  "roleARN": "string",
  "cannedACL": "string",
  "isSystem": "boolean",
  "additionalSettings": {
    "forcePathStyle": "boolean",
    "followRedirects": "boolean"
  }
}
When storageType is V_STORAGE:
{
  "region": "string",
  "container": "string",
  "endpoint": "string",
  "accessKey": "string",
  "secretKey": "string"
}

startAt
required
string <date-time>

The inclusive start of the replay window in UTC (ISO-8601).

endAt
required
string <date-time>

The exclusive end of the replay window in UTC (ISO-8601). Must be after startAt.

filter
string

The filter expression applied while replaying logs. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value replays all logs in the window.

name
required
string [ 1 .. 63 ] characters ^[A-Za-z]$|^[A-Za-z][A-Za-z\d-]{0,61}[A-Za-z\...

The name of the refill. Must be 1–63 characters and consist of letters, digits, and hyphens. Must start with a letter and end with a letter or digit.

projectId
required
string [ 0 .. 50 ] characters

The identifier of the destination project that receives the replayed logs.

description
string <= 300 characters ^[A-Za-z\d_.\- ]{0,300}$

The description of the refill. Must be 0–300 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

Responses

Request samples

Content type
application/json
{
  • "storageType": "S3",
  • "storageSettings": {},
  • "startAt": "2026-05-11T13:53:00.191Z",
  • "endAt": "2026-05-11T14:03:00.191Z",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "name": "tytv2",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "description": "Refill error logs from S3 into project tytv2"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "name": "tytv2",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "status": "PROCESSING",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "userId": 53461,
  • "storageType": "S3",
  • "storageTypeName": "S3",
  • "storageSettings": {
    },
  • "startAt": "2026-05-11T13:53:00.191Z",
  • "endAt": "2026-05-11T14:03:00.191Z",
  • "description": "Refill error logs from archive into project tytv2",
  • "processStartedAt": "2026-05-11T14:05:42.000Z",
  • "processEndedAt": "2026-05-11T14:18:30.000Z",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "updatedAt": "2026-05-11T14:18:30.000Z"
}

Test a refill storage connection

Validates the supplied storage credentials and endpoint without creating a refill.

Authorizations:
Authorization
Request Body schema: application/json
required
storageType
required
string^(S3)|(V_STORAGE)$
Enum: "S3" "V_STORAGE"

The storage backend type. Determines the expected shape of storageSettings.

storageSettings
required
object

The storage backend connection settings. The shape depends on storageType.
When storageType is S3:

{
  "region": "string",
  "bucket": "string",
  "endpoint": "string",
  "prefix": "string",
  "accessKey": "string",
  "secretKey": "string",
  "roleARN": "string",
  "cannedACL": "string",
  "isSystem": "boolean",
  "additionalSettings": {
    "forcePathStyle": "boolean",
    "followRedirects": "boolean"
  }
}
When storageType is V_STORAGE:
{
  "region": "string",
  "container": "string",
  "endpoint": "string",
  "accessKey": "string",
  "secretKey": "string"
}

Responses

Request samples

Content type
application/json
{
  • "storageType": "S3",
  • "storageSettings": {}
}

Response samples

Content type
application/json
{
  • "message": "Connection successful",
  • "success": true
}

Create a refill from an archive

Creates a refill sourced from an existing archive. Storage credentials are inherited from the archive. Returns immediately with the refill accepted for asynchronous processing.

Authorizations:
Authorization
Request Body schema: application/json
required
startAt
required
string <date-time>

The inclusive start of the replay window in UTC (ISO-8601). Must be in the past.

endAt
required
string <date-time>

The exclusive end of the replay window in UTC (ISO-8601). Must be in the past and after startAt.

filter
string

The filter expression applied while replaying logs. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value replays all logs in the window.

name
required
string [ 1 .. 63 ] characters ^[A-Za-z]$|^[A-Za-z](?:[A-Za-z\d-]){0,61}[A-Z...

The name of the refill. Must be 1–63 characters and consist of letters, digits, and hyphens. Must start with a letter and end with a letter or digit.

archiveId
required
string [ 0 .. 50 ] characters

The identifier of the source archive that holds the logs to replay.

projectId
required
string [ 0 .. 50 ] characters

The identifier of the destination project that receives the replayed logs.

description
string <= 300 characters ^[A-Za-z\d_.\- ]{0,300}$

The description of the refill. Must be 0–300 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

Responses

Request samples

Content type
application/json
{
  • "startAt": "2026-05-11T13:53:00.191Z",
  • "endAt": "2026-05-11T14:03:00.191Z",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "name": "tytv2",
  • "archiveId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "description": "Replay archive into project tytv2"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "name": "tytv2",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "status": "PROCESSING",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "userId": 53461,
  • "storageType": "S3",
  • "storageTypeName": "S3",
  • "storageSettings": {
    },
  • "startAt": "2026-05-11T13:53:00.191Z",
  • "endAt": "2026-05-11T14:03:00.191Z",
  • "description": "Refill error logs from archive into project tytv2",
  • "processStartedAt": "2026-05-11T14:05:42.000Z",
  • "processEndedAt": "2026-05-11T14:18:30.000Z",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "updatedAt": "2026-05-11T14:18:30.000Z"
}

Get a refill

Returns a single refill by its identifier.

Authorizations:
Authorization
path Parameters
refill_id
required
string
Example: f0c4e42b-95d5-4e93-9211-011d02432b55

The identifier of the refill.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/refills/f0c4e42b-95d5-4e93-9211-011d02432b55 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "name": "tytv2",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "status": "PROCESSING",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "userId": 53461,
  • "storageType": "S3",
  • "storageTypeName": "S3",
  • "storageSettings": {
    },
  • "startAt": "2026-05-11T13:53:00.191Z",
  • "endAt": "2026-05-11T14:03:00.191Z",
  • "description": "Refill error logs from archive into project tytv2",
  • "processStartedAt": "2026-05-11T14:05:42.000Z",
  • "processEndedAt": "2026-05-11T14:18:30.000Z",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "updatedAt": "2026-05-11T14:18:30.000Z"
}

Delete a refill

Deletes a refill. A refill that is still processing is stopped and marked DELETED. Logs already written to the destination project are retained.

Authorizations:
Authorization
path Parameters
refill_id
required
string
Example: f0c4e42b-95d5-4e93-9211-011d02432b55

The identifier of the refill.

Responses

Request samples 

curl --request DELETE \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/refills/f0c4e42b-95d5-4e93-9211-011d02432b55 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

Log Controller

Searches logs in a project, exports matching logs for download, and probes whether log data exists.

Search logs in a project

Executes an Elasticsearch-style log search against the caller's project. The body combines a polymorphic query tree (typically a bool filter over @timestamp and content matchers), an ordered list of sorts, a list of aggregations, and pagination via from/size. Returns the raw Elasticsearch response as a JSON string containing hits, aggregations, and metadata.

Authorizations:
Authorization
path Parameters
projectId
required
string
Example: e73b8b15-a50d-4013-85e1-43fbd942ecbb

The identifier of the project whose logs are searched.

Request Body schema: application/json
required
required
Array of objects (LogSort)

The ordered list of sort directives applied to the result set. Pass an empty list to fall back to Elasticsearch default ordering.

size
required
integer <int32> [ 0 .. 500 ]

The maximum number of hits to return.

from
required
integer <int32> >= 0

The zero-based offset of the first hit to return. Combined with size, controls pagination.

required
object (LogQuery)

A polymorphic Elasticsearch-style query node. The type discriminator selects the concrete shape of value. Supported types: bool, range, match_phrase, match, multi_match, exists, match_all. Queries compose recursively through bool, allowing arbitrarily nested filter trees.

required
Array of objects (LogAggregation)

The list of aggregations to compute alongside the hits. Pass an empty list when no aggregations are required.

Responses

Request samples

Content type
application/json
{
  • "sorts": [
    ],
  • "size": 50,
  • "from": 0,
  • "query": {
    },
  • "aggregations": [
    ]
}

Response samples

Content type
application/json
{
  • "hits": {
    },
  • "aggregations": { }
}

Search default audit logs in a project

Executes the same log search DSL against the project's default audit log index. Differs from /search-logs in that the query is augmented to scope results by the caller's identity and the underlying index is the platform-managed audit stream rather than the caller's custom logs.

Authorizations:
Authorization
path Parameters
projectId
required
string
Example: e73b8b15-a50d-4013-85e1-43fbd942ecbb

The identifier of the project whose default audit logs are searched.

Request Body schema: application/json
required
required
Array of objects (LogSort)

The ordered list of sort directives applied to the result set. Pass an empty list to fall back to Elasticsearch default ordering.

size
required
integer <int32> [ 0 .. 500 ]

The maximum number of hits to return.

from
required
integer <int32> >= 0

The zero-based offset of the first hit to return. Combined with size, controls pagination.

required
object (LogQuery)

A polymorphic Elasticsearch-style query node. The type discriminator selects the concrete shape of value. Supported types: bool, range, match_phrase, match, multi_match, exists, match_all. Queries compose recursively through bool, allowing arbitrarily nested filter trees.

required
Array of objects (LogAggregation)

The list of aggregations to compute alongside the hits. Pass an empty list when no aggregations are required.

Responses

Request samples

Content type
application/json
{
  • "sorts": [
    ],
  • "size": 50,
  • "from": 0,
  • "query": {
    },
  • "aggregations": [
    ]
}

Response samples

Content type
application/json
{
  • "hits": {
    },
  • "aggregations": { }
}

Create a log export job

Starts an asynchronous job that materializes the logs matching the supplied query into a downloadable file. Returns immediately with the job identifier and initial status. Poll GET /{projectId}/log-exports/{id} to retrieve progress and the final download URL.

Authorizations:
Authorization
path Parameters
projectId
required
string
Example: e73b8b15-a50d-4013-85e1-43fbd942ecbb

The identifier of the project whose logs are exported.

Request Body schema: application/json
required
required
Array of objects (LogSort)

The ordered list of sort directives applied to the exported logs. Pass an empty list to fall back to Elasticsearch default ordering.

required
object (LogQuery)

A polymorphic Elasticsearch-style query node. The type discriminator selects the concrete shape of value. Supported types: bool, range, match_phrase, match, multi_match, exists, match_all. Queries compose recursively through bool, allowing arbitrarily nested filter trees.

Responses

Request samples

Content type
application/json
{
  • "sorts": [
    ],
  • "query": {
    }
}

Response samples

Content type
application/json
{}

Get a log export job status

Returns the current status of a log export job, including the number of documents processed and (once the job has finished) the download URL.

Authorizations:
Authorization
path Parameters
projectId
required
string
Example: e73b8b15-a50d-4013-85e1-43fbd942ecbb

The identifier of the project owning the export job.

id
required
string
Example: f0c4e42b-95d5-4e93-9211-011d02432b55

The identifier of the export job.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/projects/e73b8b15-a50d-4013-85e1-43fbd942ecbb/log-exports/f0c4e42b-95d5-4e93-9211-011d02432b55 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{}

Check whether log data exists in a project

Returns whether the project has any indexed log data. Useful for the UI to display an onboarding empty state.

Authorizations:
Authorization
path Parameters
projectId
required
string
Example: e73b8b15-a50d-4013-85e1-43fbd942ecbb

The identifier of the project to probe.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/projects/e73b8b15-a50d-4013-85e1-43fbd942ecbb/exists-log-data \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
true

Pipeline Controller

Manages pipelines. A pipeline is a named container of processor groups that transform incoming logs before they are written to a project.

Update a pipeline

Updates the name and description of an existing pipeline.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline.

Request Body schema: application/json
required
userId
integer <int64>
name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the pipeline. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

description
string <= 255 characters ^[A-Za-z\d_.\- ]{0,255}$

The description of the pipeline. Must be 0–255 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "name": "audit-pipeline",
  • "description": "Pipeline for VKS audit logs"
}

Response samples

Content type
application/json
{
  • "id": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-pipeline",
  • "description": "Pipeline for VKS audit logs",
  • "createdAt": "2026-05-11T14:05:00.000Z"
}

Delete a pipeline

Deletes a pipeline and detaches all processor groups owned by it.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline.

Responses

Request samples 

curl --request DELETE \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/pipelines/3d752048-a797-45a4-a039-7c3c8e90a423 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

List pipelines

Returns a paginated list of pipelines owned by the caller. The query parameter performs a free-text search over the pipeline name.

Authorizations:
Authorization
query Parameters
query
string
Example: query=audit

Free-text search over the pipeline name.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/pipelines?query=audit&page=0&size=10' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Create a pipeline

Creates a new, empty pipeline owned by the caller. Processor groups can be attached to the pipeline in subsequent calls.

Authorizations:
Authorization
Request Body schema: application/json
required
userId
integer <int64>
name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the pipeline. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

description
string <= 255 characters ^[A-Za-z\d_.\- ]{0,255}$

The description of the pipeline. Must be 0–255 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "name": "audit-pipeline",
  • "description": "Pipeline for VKS audit logs"
}

Response samples

Content type
application/json
{
  • "id": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-pipeline",
  • "description": "Pipeline for VKS audit logs",
  • "createdAt": "2026-05-11T14:05:00.000Z"
}

Get a pipeline

Returns a single pipeline by its identifier, including the processor groups attached to it.

Authorizations:
Authorization
path Parameters
id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/pipelines/3d752048-a797-45a4-a039-7c3c8e90a423 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "id": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-pipeline",
  • "description": "Pipeline for VKS audit logs",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "processorGroups": [
    ]
}

Project Controller

Manages projects. A project groups related log streams and stores their indexed mappings, certificates, and access settings.

List a project's field mappings

Returns the Elasticsearch field mappings for a project together with their parser settings. Results are cached. Pass refresh=true to bypass the cache.

Authorizations:
Authorization
path Parameters
project_id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

query Parameters
refresh
boolean
Default: false

Whether to bypass the cache and re-read mappings from Elasticsearch.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/projects/332b3934-2210-450c-9912-7fb6a8d03463/mappings?refresh=false' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "name": "jsonPayload.response.body.message",
  • "elasticType": "text",
  • "type": "string",
  • "format": "date",
  • "inputFormat": "yyyy-MM-dd'T'HH:mm:ss.SSSXXX",
  • "outputFormat": "yyyy-MM-dd'T'HH:mm:ss.SSSXXX",
  • "datePattern": "yyyy-MM-dd'T'HH:mm:ss.SSSXXX",
  • "isAgg": true
}

Update a project's field mapping format

Sets or replaces the parser rule for a single field of a project. The body declares the target field, its data type, and any parser format settings.

Authorizations:
Authorization
path Parameters
project_id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

Request Body schema: application/json
required
projectId
string
name
string
type
string
format
string
inputFormat
string
outputFormat
string
datePattern
string
userId
integer <int64>

Responses

Request samples

Content type
application/json
{
  • "projectId": "string",
  • "name": "string",
  • "type": "string",
  • "format": "string",
  • "inputFormat": "string",
  • "outputFormat": "string",
  • "datePattern": "string",
  • "userId": 0
}

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

Create a project certificate

Issues a new TLS client certificate for the project. The certificate bytes are retrieved through the download endpoint.

Authorizations:
Authorization
path Parameters
id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

Responses

Request samples 

curl --request POST \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/projects/332b3934-2210-450c-9912-7fb6a8d03463/certificates \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

Update a project

Updates the description and user-defined field mappings of a project.

Authorizations:
Authorization
path Parameters
project_id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

Request Body schema: application/json
required
description
string <= 300 characters ^[A-Za-z\d_.\- ]{0,300}$

The free-text description of the project. Must be 0–300 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

Array of objects (RestUserProjectMappings)

The user-defined alias mappings from a logical portal field name to one or more system fields. Replaces the existing mapping list.

Responses

Request samples

Content type
application/json
{
  • "description": "Audit logs for tytv2",
  • "mappings": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "name": "tytv2",
  • "projectType": "project",
  • "description": "Audit logs for tytv2",
  • "timeField": "@timestamp",
  • "status": "ACTIVE",
  • "billingStatus": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "extra": {
    },
  • "certInfos": [
    ]
}

List projects

Returns a paginated list of projects owned by the caller, optionally filtered by status, billing status, and project type.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv

Free-text search over the project name.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

billing_status
string
Enum: "CREATING" "ACTIVE" "IN-ACTIVE" "ERROR" "DELETED"
Example: billing_status=ACTIVE

Filter results to projects with the given billing status.

project_type
string
Enum: "default" "required" "project"
Example: project_type=project

Filter results to projects of the given type.

status
string
Enum: "CREATING" "ACTIVE" "IN-ACTIVE" "ERROR" "DELETED"
Example: status=ACTIVE

Filter results to projects with the given lifecycle status.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/projects?query=tytv&page=0&size=10&billing_status=ACTIVE&project_type=project&status=ACTIVE' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Get a project

Returns a single project by its identifier.

Authorizations:
Authorization
path Parameters
id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/projects/332b3934-2210-450c-9912-7fb6a8d03463 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "id": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "name": "tytv2",
  • "projectType": "project",
  • "description": "Audit logs for tytv2",
  • "timeField": "@timestamp",
  • "status": "ACTIVE",
  • "billingStatus": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "extra": {
    },
  • "certInfos": [
    ]
}

Get a project's topic information

Returns the Kafka topic that backs the project's ingestion stream.

Authorizations:
Authorization
path Parameters
id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/projects/topic-info/332b3934-2210-450c-9912-7fb6a8d03463 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "topicName": "log-tytv2"
}

Delete a project certificate

Revokes and deletes a TLS client certificate from a project.

Authorizations:
Authorization
path Parameters
project_id
required
string
Example: 332b3934-2210-450c-9912-7fb6a8d03463

The identifier of the project.

cert_id
required
string
Example: 5e0a1ce6-3f88-4f5b-94cc-1f7a4e1b2d33

The identifier of the certificate.

Responses

Request samples 

curl --request DELETE \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/projects/332b3934-2210-450c-9912-7fb6a8d03463/certificates/5e0a1ce6-3f88-4f5b-94cc-1f7a4e1b2d33 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

vDB Log Mapping Controller

Manages vDB log mappings. A vDB log mapping links a vDB database resource to a destination log project that receives the database logs.

Enable vDB log mapping

Activates a vDB log mapping for the given vDB resource and sets its destination log project. The mapping starts forwarding database logs.

Authorizations:
Authorization
path Parameters
vdb-resource-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vDB resource whose mapping is being enabled.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the vDB logs.

status
required
string^(ACTIVE)$
Value: "ACTIVE"

The target status. Must be ACTIVE when enabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "ACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "vdbResourceId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "vdbResourceName": "tytv2-db",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "region": "HCM03",
  • "engineType": "MySQL",
  • "engineVersion": "8.0"
}

Edit vDB log mapping

Updates the destination log project of an existing vDB log mapping for the given vDB resource. Subsequent database logs are routed to the new project.

Authorizations:
Authorization
path Parameters
vdb-resource-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vDB resource whose mapping is being edited.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the vDB logs.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "vdbResourceId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "vdbResourceName": "tytv2-db",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "region": "HCM03",
  • "engineType": "MySQL",
  • "engineVersion": "8.0"
}

Disable vDB log mapping

Deactivates a vDB log mapping for the given vDB resource. The mapping stops forwarding database logs. Existing logs are retained.

Authorizations:
Authorization
path Parameters
vdb-resource-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vDB resource whose mapping is being disabled.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project currently linked to the mapping.

status
required
string^(INACTIVE)$
Value: "INACTIVE"

The target status. Must be INACTIVE when disabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "INACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "vdbResourceId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "vdbResourceName": "tytv2-db",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "region": "HCM03",
  • "engineType": "MySQL",
  • "engineVersion": "8.0"
}

List vDB log mappings

Returns a paginated list of vDB log mappings owned by the caller, optionally filtered by free-text query and region.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv2-db

Free-text search over the vDB resource name and related fields.

sortBy
string
Default: "createdAt"
Enum: "createdAt" "updatedAt" "name" "status"
Example: sortBy=createdAt

The field to sort by.

sortOrder
string
Default: "DESC"
Enum: "ASC" "DESC"
Example: sortOrder=DESC

The sort direction.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

region
string
Example: region=HCM03

Filter results to mappings whose vDB resource is deployed in the given region.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/vdb-log-mapping?query=tytv2-db&sortBy=createdAt&sortOrder=DESC&page=0&size=10&region=HCM03' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Processor Group Controller

Manages processor groups. A processor group is an ordered chain of processors that shares a source project, a destination project, and a group-level filter.

Get a processor group

Returns a single processor group by its identifier, including the processors attached to it.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/processor-groups/3d752048-a797-45a4-a039-7c3c8e90a423/7f062485-cc6d-47b0-ae38-51afca9fc814 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "id": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "status": "PROCESSING",
  • "description": "Audit logs from VKS cluster events",
  • "source": {
    },
  • "destination": {
    },
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "processors": [
    ]
}

Update a processor group

Updates the name, description, filter, and editor settings of an existing processor group. Source and destination projects are immutable after creation.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group to update.

Request Body schema: application/json
required
userId
integer <int64>
pipelineId
required
string

The identifier of the pipeline that owns this processor group. Overridden by the path parameter.

name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the processor group. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

description
string <= 255 characters ^[A-Za-z\d_.\- ]{0,255}$

The description of the processor group. Must be 0–255 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

filter
string <= 1024 characters

The filter expression applied to incoming logs at the group level. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value means no filter.

query
string <= 1024 characters

Alternative filter expression slot. Same DSL as filter.

editorEnable
boolean

Whether the filter editor UI is enabled for this resource.

dropFilter
boolean

Whether logs matching the filter are dropped instead of forwarded. When true, the group acts as an exclusion filter.

queryArr
string <= 1024 characters

The structured form of filter, encoded as a stringified JSON array of {key, operator, value} tokens. Used by the editor UI to render the filter visually.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "description": "Audit logs from VKS cluster events",
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]"
}

Response samples

Content type
application/json
{
  • "id": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "status": "PROCESSING",
  • "description": "Audit logs from VKS cluster events",
  • "source": {
    },
  • "destination": {
    },
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "processors": [
    ]
}

Delete a processor group

Removes a processor group from its pipeline. All processors inside the group are deleted together with the group.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group to delete.

Responses

Request samples 

curl --request DELETE \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/processor-groups/3d752048-a797-45a4-a039-7c3c8e90a423/7f062485-cc6d-47b0-ae38-51afca9fc814 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

Reorder processors in a group

Reorders the processors inside a processor group to match the order of identifiers in the request body. The first element becomes position 0.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group whose processors are reordered.

Request Body schema: application/json
required
userId
integer <int64>
pipelineId
required
string

The identifier of the pipeline. Overridden by the path parameter.

processorGroupId
required
string

The identifier of the processor group. Overridden by the path parameter.

processors
required
Array of strings

The ordered list of processor identifiers. The first element becomes position 0.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "processorGroupId": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "processors": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

Create a processor group

Creates a processor group inside the given pipeline. The group can optionally include inline processors that are created together with the group.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that will own the new processor group.

Request Body schema: application/json
required
userId
integer <int64>
pipelineId
required
string

The identifier of the pipeline that owns this processor group. Overridden by the path parameter on create.

name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the processor group. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

description
string <= 255 characters ^[A-Za-z\d_.\- ]{0,255}$

The description of the processor group. Must be 0–255 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

required
object (Project)

A project reference. Identifies a source or destination project.

required
object (Project)

A project reference. Identifies a source or destination project.

filter
string <= 1024 characters

The filter expression applied to incoming logs at the group level. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value means no filter.

query
string <= 1024 characters

Alternative filter expression slot. Same DSL as filter.

editorEnable
boolean

Whether the filter editor UI is enabled for this resource.

dropFilter
boolean

Whether logs matching the filter are dropped instead of forwarded. When true, the group acts as an exclusion filter.

queryArr
string <= 1024 characters

The structured form of filter, encoded as a stringified JSON array of {key, operator, value} tokens. Used by the editor UI to render the filter visually.

Array of objects (ProcessorRequest)

The processors to create inside this group, in execution order.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "description": "Audit logs from VKS cluster events",
  • "source": {
    },
  • "destination": {
    },
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "processors": [
    ]
}

Response samples

Content type
application/json
{
  • "id": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "name": "audit-group",
  • "status": "PROCESSING",
  • "description": "Audit logs from VKS cluster events",
  • "source": {
    },
  • "destination": {
    },
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "editorEnable": false,
  • "dropFilter": false,
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "processors": [
    ]
}

vCDN Log Mapping Controller

Manages vCDN log mappings. A vCDN log mapping links a vCDN service domain to a destination log project that receives the CDN access logs.

Enable vCDN log mapping

Activates a vCDN log mapping for the given CDN domain and sets its destination log project. The mapping starts receiving CDN access logs.

Authorizations:
Authorization
path Parameters
cdn-domain
required
string
Example: static.example.com

The CDN domain identifying the mapping to enable.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the CDN access logs.

status
required
string^(ACTIVE)$
Value: "ACTIVE"

The target status. Must be ACTIVE when enabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "ACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "cdnId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "cdnDomain": "static.example.com",
  • "domainName": "static.example.com",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "type": "webacc",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z"
}

Edit vCDN log mapping

Updates the destination log project of an existing vCDN log mapping for the given CDN domain. Subsequent CDN access logs are routed to the new project.

Authorizations:
Authorization
path Parameters
cdn-domain
required
string
Example: static.example.com

The CDN domain identifying the mapping to edit.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the CDN access logs.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "cdnId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "cdnDomain": "static.example.com",
  • "domainName": "static.example.com",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "type": "webacc",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z"
}

Disable vCDN log mapping

Deactivates a vCDN log mapping for the given CDN domain. The mapping stops forwarding CDN access logs to the destination project. Existing logs are retained.

Authorizations:
Authorization
path Parameters
cdn-domain
required
string
Example: static.example.com

The CDN domain identifying the mapping to disable.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project currently linked to the mapping.

status
required
string^(INACTIVE)$
Value: "INACTIVE"

The target status. Must be INACTIVE when disabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "INACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "cdnId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "cdnDomain": "static.example.com",
  • "domainName": "static.example.com",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "type": "webacc",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z"
}

List vCDN log mappings

Returns a paginated list of vCDN log mappings owned by the caller, optionally filtered by free-text query and vCDN service type.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=static.example.com

Free-text search over the CDN domain and related fields.

sortBy
string
Default: "createdAt"
Enum: "createdAt" "updatedAt" "name" "status"
Example: sortBy=createdAt

The field to sort by.

sortOrder
string
Default: "DESC"
Enum: "ASC" "DESC"
Example: sortOrder=DESC

The sort direction.

page
integer >= 0
Default: 0

The zero-based page index.

type
string [ 0 .. 50 ] characters
Enum: "webacc" "obj-download" "vod" "live"
Example: type=webacc

Filter results to mappings backed by the given vCDN service type.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/vcdn-log-mapping?query=static.example.com&sortBy=createdAt&sortOrder=DESC&page=0&type=webacc&size=10' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

List vCDN log mapping types

Returns the distinct vCDN service types that appear across the caller's vCDN log mappings. Used to populate the type filter in the console.

Authorizations:
Authorization

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/vcdn-log-mapping/type \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
[
  • {
    }
]

vLB Log Mapping Controller

Manages vLB log mappings. A vLB log mapping links a vLB load balancer project to a destination log project that receives the load balancer logs.

Enable vLB log mapping

Activates a vLB log mapping for the given vLB project and sets its destination log project. The mapping starts forwarding load balancer logs.

Authorizations:
Authorization
path Parameters
vlb-project-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vLB project whose mapping is being enabled.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the vLB logs.

status
required
string^(ACTIVE)$
Value: "ACTIVE"

The target status. Must be ACTIVE when enabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "ACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "vlbProjectId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "vlbProjectName": "tytv2-vlb",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "region": "HCM03"
}

Edit vLB log mapping

Updates the destination log project of an existing vLB log mapping for the given vLB project. Subsequent load balancer logs are routed to the new project.

Authorizations:
Authorization
path Parameters
vlb-project-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vLB project whose mapping is being edited.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the vLB logs.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "vlbProjectId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "vlbProjectName": "tytv2-vlb",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "region": "HCM03"
}

Disable vLB log mapping

Deactivates a vLB log mapping for the given vLB project. The mapping stops forwarding load balancer logs. Existing logs are retained.

Authorizations:
Authorization
path Parameters
vlb-project-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vLB project whose mapping is being disabled.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project currently linked to the mapping.

status
required
string^(INACTIVE)$
Value: "INACTIVE"

The target status. Must be INACTIVE when disabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "INACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "vlbProjectId": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "vlbProjectName": "tytv2-vlb",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "region": "HCM03"
}

List vLB log mappings

Returns a paginated list of vLB log mappings owned by the caller, optionally filtered by free-text query and region.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv2-vlb

Free-text search over the vLB project name and related fields.

sortBy
string
Default: "createdAt"
Enum: "createdAt" "updatedAt" "name" "status"
Example: sortBy=createdAt

The field to sort by.

sortOrder
string
Default: "DESC"
Enum: "ASC" "DESC"
Example: sortOrder=DESC

The sort direction.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

region
string
Example: region=HCM03

Filter results to mappings whose vLB project is deployed in the given region.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/vlb-log-mapping?query=tytv2-vlb&sortBy=createdAt&sortOrder=DESC&page=0&size=10&region=HCM03' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Processor Controller

Manages processors. A processor is a single transformation step (e.g. JSON parse, GROK match, date parse) within a processor group.

Update a processor

Updates the configuration of an existing processor. The processor's group and pipeline are fixed; only mutable fields (name, parser type, parser rule, filter) change.

Authorizations:
Authorization
path Parameters
processor_id
required
string
Example: a3f1b5e2-9c4d-4f8a-b6e7-1c2d3e4f5a6b

The identifier of the processor to update.

pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group that owns the processor.

Request Body schema: application/json
required
userId
integer <int64>
pipelineId
required
string

The identifier of the pipeline that owns this processor. Overridden by the path parameter on create/update.

processorGroupId
required
string

The identifier of the processor group that owns this processor. Overridden by the path parameter on create/update.

name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the processor. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

parserType
required
string
Enum: "CSV" "DATE" "GEO_IP" "GROK" "JSON" "RE_MAPPER" "USER_AGENT" "CSV" "DATE" "GEO_IP" "GROK" "JSON" "RE_MAPPER" "USER_AGENT"

The parser type that determines how this processor interprets the source field.

parserRule
required
string

Stringified JSON parser configuration. The inner shape depends on parserType (e.g. for JSON parser: {sourceField, targetField, skipOnInvalid}).

filter
string <= 1024 characters

The filter expression applied before the processor runs. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value means no filter.

query
string <= 1024 characters

Alternative filter expression slot. Same DSL as filter.

queryArr
string <= 1024 characters

The structured form of filter, encoded as a stringified JSON array of {key, operator, value} tokens. Used by the editor UI to render the filter visually.

object (ParserRuleRequest)

The request body for persisting a parser rule preset that can be reused across processors.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "processorGroupId": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "name": "demo",
  • "parserType": "JSON",
  • "parserRule": "{\"sourceField\":\"jsonPayload.response.body.message\",\"targetField\":\"\",\"skipOnInvalid\":true}",
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "rulePreset": {
    }
}

Response samples

Content type
application/json
{
  • "id": "a3f1b5e2-9c4d-4f8a-b6e7-1c2d3e4f5a6b",
  • "processorGroupId": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "name": "demo",
  • "parserType": {
    },
  • "parserRule": "{\"sourceField\":\"jsonPayload.response.body.message\",\"targetField\":\"\",\"skipOnInvalid\":true}",
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\""
}

Delete a processor

Removes a processor from its processor group. Remaining processors in the group keep their order.

Authorizations:
Authorization
path Parameters
processor_id
required
string
Example: a3f1b5e2-9c4d-4f8a-b6e7-1c2d3e4f5a6b

The identifier of the processor to delete.

pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group that owns the processor.

Responses

Request samples 

curl --request DELETE \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/processors/3d752048-a797-45a4-a039-7c3c8e90a423/7f062485-cc6d-47b0-ae38-51afca9fc814/a3f1b5e2-9c4d-4f8a-b6e7-1c2d3e4f5a6b \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

Create a processor

Creates a processor inside the given processor group. The processor is appended at the end of the group's processor chain.

Authorizations:
Authorization
path Parameters
pipeline_id
required
string
Example: 3d752048-a797-45a4-a039-7c3c8e90a423

The identifier of the pipeline that owns the processor group.

processor_group_id
required
string
Example: 7f062485-cc6d-47b0-ae38-51afca9fc814

The identifier of the processor group that will own the new processor.

Request Body schema: application/json
required
userId
integer <int64>
pipelineId
required
string

The identifier of the pipeline that owns this processor. Overridden by the path parameter on create/update.

processorGroupId
required
string

The identifier of the processor group that owns this processor. Overridden by the path parameter on create/update.

name
required
string [ 1 .. 63 ] characters ^[a-z]$|^[a-z](?:[a-z\d-]){0,61}[a-z\d]$

The name of the processor. Must be 1–63 characters, lowercase letters, digits and hyphens only. Must start with a letter and end with a letter or digit.

parserType
required
string
Enum: "CSV" "DATE" "GEO_IP" "GROK" "JSON" "RE_MAPPER" "USER_AGENT" "CSV" "DATE" "GEO_IP" "GROK" "JSON" "RE_MAPPER" "USER_AGENT"

The parser type that determines how this processor interprets the source field.

parserRule
required
string

Stringified JSON parser configuration. The inner shape depends on parserType (e.g. for JSON parser: {sourceField, targetField, skipOnInvalid}).

filter
string <= 1024 characters

The filter expression applied before the processor runs. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value means no filter.

query
string <= 1024 characters

Alternative filter expression slot. Same DSL as filter.

queryArr
string <= 1024 characters

The structured form of filter, encoded as a stringified JSON array of {key, operator, value} tokens. Used by the editor UI to render the filter visually.

object (ParserRuleRequest)

The request body for persisting a parser rule preset that can be reused across processors.

Responses

Request samples

Content type
application/json
{
  • "userId": 0,
  • "pipelineId": "3d752048-a797-45a4-a039-7c3c8e90a423",
  • "processorGroupId": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "name": "demo",
  • "parserType": "JSON",
  • "parserRule": "{\"sourceField\":\"jsonPayload.response.body.message\",\"targetField\":\"\",\"skipOnInvalid\":true}",
  • "filter": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\"",
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "rulePreset": {
    }
}

Response samples

Content type
application/json
{
  • "id": "a3f1b5e2-9c4d-4f8a-b6e7-1c2d3e4f5a6b",
  • "processorGroupId": "7f062485-cc6d-47b0-ae38-51afca9fc814",
  • "name": "demo",
  • "parserType": {
    },
  • "parserRule": "{\"sourceField\":\"jsonPayload.response.body.message\",\"targetField\":\"\",\"skipOnInvalid\":true}",
  • "queryArr": "[{\"key\":\"jsonPayload.action.keyword\",\"operator\":\"=\",\"value\":\"\\\"vks:CreateCluster\\\"\"}]",
  • "query": "jsonPayload.action.keyword = \"vks:CreateCluster\""
}

Debug a grok pattern

Runs the supplied grok pattern against the supplied sample log line and returns the captured variable bindings. Used by the UI to preview a GROK processor configuration before persisting it.

Authorizations:
Authorization
Request Body schema: application/json
required
log
string

The sample log line to parse.

pattern
required
string

The grok pattern to apply to the log line.

Responses

Request samples

Content type
application/json
{
  • "log": "2026-05-11T13:53:00.191Z INFO vks:CreateCluster cluster-id=abc123",
  • "pattern": "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{DATA:action} cluster-id=%{WORD:clusterId}"
}

Response samples

Content type
application/json
{ }

List supported date format patterns

Returns the list of date format patterns supported by the DATE parser processor type.

Authorizations:
Authorization

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/processors/formats-date \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
[
  • "yyyy-MM-dd'T'HH:mm:ss.SSSXXX"
]

vStorage Log Mapping Controller

Manages vStorage log mappings. A vStorage log mapping links a vStorage project to a destination log project that receives the vStorage access logs.

Enable vStorage log mapping

Activates a vStorage log mapping for the given vStorage project and sets its destination log project. The mapping starts forwarding access logs.

Authorizations:
Authorization
path Parameters
vstorage-project-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vStorage project whose mapping is being enabled.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the vStorage logs.

status
required
string^(ACTIVE)$
Value: "ACTIVE"

The target status. Must be ACTIVE when enabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "ACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "regionName": "HCM03",
  • "userId": 53461,
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "vstorageProjectName": "string",
  • "vstorageProjectId": "string"
}

Edit vStorage log mapping

Updates the destination log project of an existing vStorage log mapping for the given vStorage project. Subsequent access logs are routed to the new project.

Authorizations:
Authorization
path Parameters
vstorage-project-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vStorage project whose mapping is being edited.

Request Body schema: application/json
required
logProjectId
required
string

The identifier of the destination log project that will receive the vStorage logs.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "regionName": "HCM03",
  • "userId": 53461,
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "vstorageProjectName": "string",
  • "vstorageProjectId": "string"
}

Disable vStorage log mapping

Deactivates a vStorage log mapping for the given vStorage project. The mapping stops forwarding access logs. Existing logs are retained.

Authorizations:
Authorization
path Parameters
vstorage-project-id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the vStorage project whose mapping is being disabled.

Request Body schema: application/json
required
logProjectId
string

The identifier of the destination log project currently linked to the mapping.

status
required
string^(INACTIVE)$
Value: "INACTIVE"

The target status. Must be INACTIVE when disabling a mapping.

Responses

Request samples

Content type
application/json
{
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "status": "INACTIVE"
}

Response samples

Content type
application/json
{
  • "id": "f0c4e42b-95d5-4e93-9211-011d02432b55",
  • "logProjectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "logProjectName": "tytv2",
  • "status": "ACTIVE",
  • "regionName": "HCM03",
  • "userId": 53461,
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "vstorageProjectName": "string",
  • "vstorageProjectId": "string"
}

List vStorage log mappings

Returns a paginated list of vStorage log mappings owned by the caller, optionally filtered by free-text query and region.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv2-vstorage

Free-text search over the vStorage project name and related fields.

sortBy
string
Default: "createdAt"
Enum: "createdAt" "updatedAt" "name" "status"
Example: sortBy=createdAt

The field to sort by.

sortOrder
string
Default: "DESC"
Enum: "ASC" "DESC"
Example: sortOrder=DESC

The sort direction.

region-id
string [ 0 .. 50 ] characters
Example: region-id=HCM03

Filter results to mappings whose vStorage project is deployed in the given region.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/vstorage-log-mappings?query=tytv2-vstorage&sortBy=createdAt&sortOrder=DESC&region-id=HCM03&page=0&size=10' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

List vStorage log mapping regions

Returns the distinct regions in which the caller has vStorage log mappings. Used to populate the region filter in the console.

Authorizations:
Authorization

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/vstorage-log-mappings/regions \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
[
  • {
    }
]

Archive Controller

Manages archives. An archive is a long-running asynchronous job that exports a project's logs into an external object storage backend.

Get an archive

Returns a single archive by its identifier.

Authorizations:
Authorization
path Parameters
archive_id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the archive.

Responses

Request samples 

curl --request GET \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/archives/4b412469-4da1-4a86-95f1-4e9af32b1f37 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "id": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "name": "tytv2",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "status": "PROCESSING",
  • "description": "Archive of project tytv2 logs to S3",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "userId": 53461,
  • "storageType": "S3",
  • "storageTypeName": "S3",
  • "storageSettings": {
    },
  • "processStartedAt": "2026-05-11T14:05:42.000Z",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "updatedAt": "2026-05-11T14:18:30.000Z"
}

Update an archive

Replaces the storage settings, source project, and filter of an existing archive.

Authorizations:
Authorization
path Parameters
archive_id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the archive.

Request Body schema: application/json
required
storageType
required
string^(S3)|(V_STORAGE)$
Enum: "S3" "V_STORAGE"

The storage backend type. Determines the expected shape of storageSettings.

storageSettings
required
object

The storage backend connection settings. The shape depends on storageType.
When storageType is S3:

{
  "region": "string",
  "bucket": "string",
  "endpoint": "string",
  "prefix": "string",
  "accessKey": "string",
  "secretKey": "string",
  "roleARN": "string",
  "cannedACL": "string",
  "isSystem": "boolean",
  "additionalSettings": {
    "forcePathStyle": "boolean",
    "followRedirects": "boolean"
  }
}
When storageType is V_STORAGE:
{
  "region": "string",
  "container": "string",
  "endpoint": "string",
  "accessKey": "string",
  "secretKey": "string"
}

filter
string

The filter expression applied while exporting logs. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value archives all logs.

projectId
required
string [ 0 .. 50 ] characters

The identifier of the source project whose logs are archived.

Responses

Request samples

Content type
application/json
{
  • "storageType": "S3",
  • "storageSettings": {},
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463"
}

Response samples

Content type
application/json
{
  • "id": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "name": "tytv2",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "status": "PROCESSING",
  • "description": "Archive of project tytv2 logs to S3",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "userId": 53461,
  • "storageType": "S3",
  • "storageTypeName": "S3",
  • "storageSettings": {
    },
  • "processStartedAt": "2026-05-11T14:05:42.000Z",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "updatedAt": "2026-05-11T14:18:30.000Z"
}

Delete an archive

Deletes an archive. An archive that is still processing is stopped and marked DELETED. Logs already written to the destination storage are retained.

Authorizations:
Authorization
path Parameters
archive_id
required
string
Example: 4b412469-4da1-4a86-95f1-4e9af32b1f37

The identifier of the archive.

Responses

Request samples 

curl --request DELETE \
  --url https://vmonitorapi.vngcloud.vn/log-api/v1/archives/4b412469-4da1-4a86-95f1-4e9af32b1f37 \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "message": "Refill name must be between 1 and 63 characters long."
}

List archives

Returns a paginated list of archives owned by the caller. When project_id is supplied, results are filtered to archives sourced from that project.

Authorizations:
Authorization
query Parameters
query
string [ 0 .. 50 ] characters
Example: query=tytv

Free-text search over the archive name.

project_id
string
Example: project_id=332b3934-2210-450c-9912-7fb6a8d03463

Filter results to archives sourced from the given project.

page
integer >= 0
Default: 0

The zero-based page index.

size
integer [ 1 .. 100 ]
Default: 10
Example: size=10

The number of items per page.

Responses

Request samples 

curl --request GET \
  --url 'https://vmonitorapi.vngcloud.vn/log-api/v1/archives?query=tytv&project_id=332b3934-2210-450c-9912-7fb6a8d03463&page=0&size=10' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

Response samples

Content type
application/json
{
  • "content": [
    ],
  • "totalPages": 5,
  • "totalElements": 47,
  • "currentPage": 0,
  • "pageSize": 10
}

Create an archive

Creates an archive that exports a project's logs into an external S3 or vStorage backend. Returns immediately with the archive accepted for asynchronous processing.

Authorizations:
Authorization
Request Body schema: application/json
required
storageType
required
string^(S3)|(V_STORAGE)$
Enum: "S3" "V_STORAGE"

The storage backend type. Determines the expected shape of storageSettings.

storageSettings
required
object

The storage backend connection settings. The shape depends on storageType.
When storageType is S3:

{
  "region": "string",
  "bucket": "string",
  "endpoint": "string",
  "prefix": "string",
  "accessKey": "string",
  "secretKey": "string",
  "roleARN": "string",
  "cannedACL": "string",
  "isSystem": "boolean",
  "additionalSettings": {
    "forcePathStyle": "boolean",
    "followRedirects": "boolean"
  }
}
When storageType is V_STORAGE:
{
  "region": "string",
  "container": "string",
  "endpoint": "string",
  "accessKey": "string",
  "secretKey": "string"
}

filter
string

The filter expression applied while exporting logs. Uses field operator value tokens combined with AND / OR. Supported operators include = and !=; string values are double-quoted. Append .keyword to a field name to match the non-analyzed Elasticsearch field. An empty value archives all logs.

name
required
string [ 1 .. 63 ] characters ^[A-Za-z]$|^[A-Za-z](?:[A-Za-z\d-]){0,61}[A-Z...

The name of the archive. Must be 1–63 characters and consist of letters, digits, and hyphens. Must start with a letter and end with a letter or digit.

projectId
required
string [ 0 .. 50 ] characters

The identifier of the source project whose logs are archived.

description
string <= 300 characters ^[A-Za-z\d_.\- ]{0,300}$

The description of the archive. Must be 0–300 characters and consist of letters, digits, underscores, dots, spaces, and hyphens.

Responses

Request samples

Content type
application/json
{
  • "storageType": "S3",
  • "storageSettings": {},
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "name": "tytv2",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "description": "Archive of project tytv2 logs to S3"
}

Response samples

Content type
application/json
{
  • "id": "4b412469-4da1-4a86-95f1-4e9af32b1f37",
  • "name": "tytv2",
  • "filter": "client_country.keyword = \"VN\" AND message != \"demo\"",
  • "status": "PROCESSING",
  • "description": "Archive of project tytv2 logs to S3",
  • "projectId": "332b3934-2210-450c-9912-7fb6a8d03463",
  • "userId": 53461,
  • "storageType": "S3",
  • "storageTypeName": "S3",
  • "storageSettings": {
    },
  • "processStartedAt": "2026-05-11T14:05:42.000Z",
  • "createdAt": "2026-05-11T14:05:00.000Z",
  • "updatedAt": "2026-05-11T14:18:30.000Z"
}

Test an archive storage connection

Validates the supplied storage credentials and endpoint without creating an archive.

Authorizations:
Authorization
Request Body schema: application/json
required
storageType
required
string^(S3)|(V_STORAGE)$
Enum: "S3" "V_STORAGE"

The storage backend type. Determines the expected shape of storageSettings.

storageSettings
required
object

The storage backend connection settings. The shape depends on storageType.
When storageType is S3:

{
  "region": "string",
  "bucket": "string",
  "endpoint": "string",
  "prefix": "string",
  "accessKey": "string",
  "secretKey": "string",
  "roleARN": "string",
  "cannedACL": "string",
  "isSystem": "boolean",
  "additionalSettings": {
    "forcePathStyle": "boolean",
    "followRedirects": "boolean"
  }
}
When storageType is V_STORAGE:
{
  "region": "string",
  "container": "string",
  "endpoint": "string",
  "accessKey": "string",
  "secretKey": "string"
}

Responses

Request samples

Content type
application/json
{
  • "storageType": "S3",
  • "storageSettings": {}
}

Response samples

Content type
application/json
{
  • "message": "Connection successful",
  • "success": true
}