​

ves-io-schema-app_security-AppSecurityMonitoringAPI-SuspiciousUserLogsAggregationQuery

Published April 5, 2023 | Last modified November 14, 2025

Examples of performing app_security AppSecurityMonitoringAPI SuspiciousUserLogsAggregationQuery

Usecase:

Suspicious user logs aggregation request for virtual host vhost1 in namespace ns1

Request:

Request using vesctl:

vesctl request rpc app_security.AppSecurityMonitoringAPI.SuspiciousUserLogsAggregationQuery -i request.yaml --uri /public/namespaces/ns1/app_security/suspicious_user_logs/aggregation --http-method POST

where file request.yaml has following contents:

aggs:
  date_histogram:
    dateAggregation:
      step: 1h
endTime: "1591131600"
query: '{vh_name="vhost1"}'
startTime: "1591120800"
Copied!

vesctl yaml response:

aggs: {}
Copied!

Request using curl:

curl -X 'POST' -d '{"query":"{vh_name=\"vhost1\"}","start_time":"1591120800","end_time":"1591131600","aggs":{"date_histogram":{"date_aggregation":{"step":"1h"}}}}' -H 'Content-Type: application/json' -H 'X-Volterra-Useragent: v1/pgm=_var_folders_q2_3kp8z3zs0x5_m7pk1bgb0_ph0000gp_T_go-build4194363419_b001_apidocs.test/host=MTY6VVHQPH/svc=S:examplesvc/site=mytestce01' 'https://acmecorp.console.ves.volterra.io/api/data/namespaces/ns1/app_security/suspicious_user_logs/aggregation'
Copied!

curl response:

HTTP/1.1 200 OK
Content-Length: 40
Content-Type: application/json
Date: Thu, 13 Nov 2025 23:05:41 GMT
Vary: Accept-Encoding

{
  "total_hits": "0",
  "aggs": {
  }
}
Copied!
On this page: