Follow Use LogPoint’s Search API, which works in two calls to the same endpoint, /getsearchlogs. The first call sends your query, time range and repos, and returns a search_id. The second call sends that search_id and returns the rows once the search is final. Both calls are form-encoded POSTs authenticated with your username and secret key.
LogPoint is a popular SIEM in Europe, and the Search API is the cleanest way to get a defined slice of its data out. Prime Core has 19,598 detection rules for LogPoint, mapped to 664 MITRE ATT&CK techniques. Below is how to get logs out, sanitize them, and investigate them for free in LogTotal.
Before you start
Your secret key. Every API call carries your LogPoint username and secret key. You find the key in your user profile’s access key settings. Treat it like a password.
Repo names. Searches run against repos, written as <ip>:5504/<repo>, for example 127.0.0.1:5504/_logpoint. The same endpoint family lists them for you (getalloweddata with type logpoint_repos).
Time range. time_range takes either a preset like “Last 24 hours” or a pair of epoch seconds. For incident work, use the epoch pair; date -d ‘2026-10-19T00:00:00Z’ +%s computes it.
Export with the Search API
LP="https://logpoint.example.com"
# 1. start the search (2026-10-19 00:00 UTC to 2026-10-20 00:00 UTC)
SID=$(curl -sS "$LP/getsearchlogs" \
--data-urlencode "username=$LP_USER" --data-urlencode "secret_key=$LP_KEY" \
--data-urlencode 'requestData={"query": "device_ip=10.0.0.5", "time_range": [1792368000, 1792454400], "limit": 10000, "repos": ["127.0.0.1:5504/_logpoint"]}' \
| jq -r '.search_id')
# 2. fetch results until the search is final
while :; do
R=$(curl -sS "$LP/getsearchlogs" \
--data-urlencode "username=$LP_USER" --data-urlencode "secret_key=$LP_KEY" \
--data-urlencode "requestData={\"search_id\": \"$SID\"}")
[ "$(echo "$R" | jq -r '.final')" = "true" ] && break
sleep 3
done
echo "$R" | jq -c '.rows[]' > logpoint_1019.jsonl
echo "$R" | jq -r '.rows[].msg // empty' > logpoint_1019_raw.log
Keep the query a filter. A query with | chart or other aggregations returns aggregated rows, not logs. The raw log usually sits in the msg field.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
What this looks like on real data.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Authentication error | Wrong username or secret key | Copy the key again from your profile |
| Empty results | Wrong repo string, or the time range is in milliseconds | List repos via getalloweddata; use epoch seconds |
| Aggregated rows instead of logs | Query includes chart or similar | Use a plain filter |
| Results cut short | limit reached | Raise it, or split the window |
| Request rejected | Not sent as form data | Send application/x-www-form-urlencoded |
FAQ
Can I do this through LogPoint Director?
Yes. Director’s API has its own search call for managed LogPoints. Use it if you manage several instances centrally.
Does the UI export work?
For small, quick exports, yes. For anything you want to repeat or keep tight, the API gives you more control.
