Method: logTypes.list

Full name: projects.locations.instances.logTypes.list

Lists all LogTypes.

HTTP request

GET https://{endpoint}/v1beta/{parent}/logTypes

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns this collection of log types. Format: projects/{project}/locations/{region}/instances/{instance}

Query parameters

Parameters
pageSize

integer

The maximum number of log types to return. The service may return fewer than this value.
pageToken

string

A page token, received from a previous logTypes.list call. Provide this to retrieve the subsequent page.

When paginating, all other parameters provided to logTypes.list must match the call that provided the page token.
filter

string

Optional. A filter which should follow the guidelines of AIP-160
orderBy

string

Optional. The sorting order for the list of log types. The only field supported for sorting is data_size. Data size is the total size for each log type that have been ingested for the customer for lifetime. The valid values are "data_size", "data_size asc", "data_size desc". If just "data_size" is specified, it defaults to ascending order of data size. If nothing is specified, results are returned in ascending order of name.

Request body

The request body must be empty.

Response body

Response message for listing log types.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "logTypes": [
    {
      object (LogType)
    }
  ],
  "nextPageToken": string
}
Fields
logTypes[]

object (LogType)

The log types from the specified chronicle instance.
nextPageToken

string

A token, which can be sent as pageToken to retrieve the next page. If this field is omitted, there are no subsequent pages.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.logTypes.list

For more information, see the IAM documentation.

LogType

A Log type represents a data label for data customers send to Chronicle.

JSON representation 
{
  "name": string,
  "customLogTypeLabel": string,
  "displayName": string,
  "golden": boolean,
  "productSource": string,
  "isCustom": boolean,
  "hasCustomParser": boolean,
  "lastIngestedTime": string,
  "feedCount": integer,
  "parserType": enum (ParserType),
  "collectionTime": string
}
Fields
name

string

Output only. The resource name of this log type. Format: projects/{project}/locations/{region}/instances/{instance}/logTypes/{logType}
customLogTypeLabel

string

Output only. the custom log type label
displayName

string

Required. The display name of this log type. This is the tag used in YARA-l rules and search queries.
golden

boolean

Output only. Whether a LogType is a 'Golden' log type or not. LogTypes that support rapid customer onboarding are considered 'Golden' log types.
productSource

string

Required. This is what users see in the UI to identify the logtype while creating feed.
isCustom

boolean

Required. Whether the log type is custom or globally available.
hasCustomParser

boolean

Required. The log type could be custom logtype but still be using prebuilt parser. If this is set to true that means that there is a custom parser for this log type. ( deprecated )
lastIngestedTime

string (Timestamp format)

Required. The last time the log type was ingested.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
feedCount

integer

Output only. The number of feeds that are ingested for this log type. This field is populated from FeedManagementService and will be -1 if the feed count cannot be determined due to an error.
parserType

enum (ParserType)

Required. The type of parser used for this log type. (custom/prebuilt/-)
collectionTime

string (Timestamp format)

Output only. The time of the most recent log collection for this log type.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

ParserType

enum for getting a ParserType.

Enums
PARSER_TYPE_UNSPECIFIED Unspecified parser type.
CUSTOM_PARSER Custom parser.
PREBUILT_PARSER Prebuilt parser.