LogVault

Overview

LogVault is a centralised log storage and search system for StarkOne. It ingests logs from multiple sources, stores them in a searchable index, and provides a web-based search interface with saved search support.

Requires the logvault plugin to be enabled. All endpoints require superuser.

Status & Installation

# LogVault status
GET /api/logvault/status

# Install LogVault
POST /api/logvault/install

# Uninstall
POST /api/logvault/uninstall

Log Sources

Sources define where LogVault reads logs from.

List Sources

GET /api/logvault/sources

Response:

{
  "data": [
    {
      "id": 1,
      "name": "Nginx Access",
      "type": "file",
      "path": "/var/log/nginx/access.log",
      "enabled": true
    }
  ]
}

Create a Source

POST /api/logvault/sources
{
  "name": "My App Log",
  "type": "file",
  "path": "/home/example/logs/app.log",
  "format": "combined"
}

Update a Source

PUT /api/logvault/sources/:id
{ "enabled": false }

Delete a Source

DELETE /api/logvault/sources/:id

Toggle a Source

POST /api/logvault/sources/:id/toggle

Apply Source Changes

POST /api/logvault/sources/:id/apply

Writes the updated source configuration and restarts the log collector.

Searching Logs

POST /api/logvault/search
{
  "query": "error 500",
  "source_ids": [1, 2],
  "from": "2024-01-15T00:00:00Z",
  "to": "2024-01-15T23:59:59Z",
  "limit": 100,
  "offset": 0
}

Response:

{
  "data": {
    "hits": [
      {
        "timestamp": "2024-01-15T10:32:11Z",
        "source": "Nginx Access",
        "message": "[error] 500 internal server error - /api/login"
      }
    ],
    "total": 42
  }
}

Statistics

GET /api/logvault/stats

Returns log volume by source, time range, and error rates.

Preserved Log Count

GET /api/logvault/preserved-count

Saved Searches

# List saved searches
GET /api/logvault/saved-searches

# Create a saved search
POST /api/logvault/saved-searches
{
  "name": "500 Errors Today",
  "query": "error 500",
  "source_ids": [1]
}

# Delete a saved search
DELETE /api/logvault/saved-searches/:id