# Litmus Edge Manager 3.0.x - Edge Lifecycle: Edge Logs

## Query logs

**POST** `{{LEM_URL}}/api/v1/edge-logs/query`

# Query logs

Searches forwarded edge-device logs with filters and pagination. Pair with the device log-forwarding endpoints, which feed this store.
## Endpoint

```http
POST {{LEM_URL}}/api/v1/edge-logs/query
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

`LogQueryRequest`:

| Field | Notes |
|---|---|
| `projectId` | Project scope. |
| `start` / `end` | Time window (ISO-8601). |
| `deviceId` / `hostname` | Restrict to one device. |
| `service` | Filter by service name(s). |
| `severity` | Filter by log severity level(s). |
| `text` | Full-text search. |
| `offset` / `limit` | Pagination. |

## Response

A paged set of matching log entries.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "projectId": "string",
  "start": "string",
  "end": "string",
  "deviceId": "string",
  "hostname": "string",
  "service": [
    "string"
  ],
  "severity": [
    "string"
  ],
  "text": "string",
  "offset": 0,
  "limit": 0
}
```

### Response

**Status**: 200 OK

```json
[]
```

---

## Get log hits

**POST** `{{LEM_URL}}/api/v1/edge-logs/hits`

# Get log hits

Returns a time-bucketed count of matching log entries (a histogram), for charting log volume over a window.
## Endpoint

```http
POST {{LEM_URL}}/api/v1/edge-logs/hits
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

`LogHitsRequest`:

| Field | Notes |
|---|---|
| `projectId` | Project scope. |
| `start` / `end` | Time window (ISO-8601). |
| `deviceId` / `hostname` | Restrict to one device. |
| `service` | Filter by service name(s). |
| `severity` | Filter by log severity level(s). |
| `text` | Full-text search. |
| `step` | Bucket size for the histogram. |

## Response

Per-bucket hit counts across the requested window.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "projectId": "string",
  "start": "string",
  "end": "string",
  "deviceId": "string",
  "hostname": "string",
  "service": [
    "string"
  ],
  "severity": [
    "string"
  ],
  "text": "string",
  "step": "string"
}
```

### Response

**Status**: 200 OK

```json
{
  "hits": []
}
```

---

## Get log statistics

**POST** `{{LEM_URL}}/api/v1/edge-logs/statistics`

# Get log statistics

Returns aggregate statistics over matching logs (e.g. counts by severity, optionally grouped by hostname).
## Endpoint

```http
POST {{LEM_URL}}/api/v1/edge-logs/statistics
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

`LogStatisticsRequest`:

| Field | Notes |
|---|---|
| `projectId` | Project scope. |
| `start` / `end` | Time window (ISO-8601). |
| `deviceId` / `hostname` | Restrict to one device. |
| `service` | Filter by service name(s). |
| `severity` | Filter by log severity level(s). |
| `text` | Full-text search. |
| `groupByHostname` | Break the stats down per host. |

## Response

Aggregated log statistics.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "projectId": "string",
  "start": "string",
  "end": "string",
  "deviceId": "string",
  "service": [
    "string"
  ],
  "severity": [
    "string"
  ],
  "groupByHostname": true
}
```

### Response

**Status**: 200 OK

```json
[]
```

---