LogCollector is a datatype for a Fleet search result entry.

Table: LogCollector

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 26, 2025
cfgTestIdstring  Short-TermThe configuration test identifier.
changeChanges  Short-TermA change to the log collector. See Changes.
configIdstring  Short-TermContains the unique identifier of any manually assigned configuration.
configNamestring  Short-TermContains the name of any manually assigned configuration.
configurations[LogCollectorConfigInfo]yes Short-TermThe log collector configurations. See LogCollectorConfigInfo.
CpuAverage5Minfloat  Short-TermCPU Average for five minutes.
debugLoggingLogCollectorDebugLogging  Short-TermDebugging information on logging. See LogCollectorDebugLoggingStatic.
diskMax5Minfloat  Short-TermDisk usage for a maximum of five minutes.
ephemeralTimeoutinteger  Short-TermThe ephemeral timeout in milliseconds.
errors[string]yes Short-TermErrors returned.
groups[LogCollectorGroup]yes Short-TermThe log collector groups. See LogCollectorGroup.
Hostnamestringyes Short-TermThe hostname.
idstring  Short-TermIf the collector is enrolled, this is its unique identifier.
ingestLast24Hlongyes Short-TermIngest last twenty-four hours.
ipAddressstring  Short-TermThe IP address.
labels[LogCollectorLabel]yes Short-TermThe log collector labels. See LogCollectorLabel.
LastActivitystringyes Short-TermLast activity recorded
logSources[LogCollectorLogSource]yes Short-TermThe log sources. See LogCollectorLogSource.
machineIdstringyes Short-TermThe log collector machine identifier.
MemoryMax5Minlong  Short-TermMaximum memory for five minutes.
statusLogCollectorStatusType  Short-TermThe status of the log collector. See LogCollectorStatusType.
Systemstringyes Short-TermThe host system.
timeOfUpdatedatetime  Short-TermThe date and time of update.
usesRemoteUpdatebooleanyes Short-TermWhether the log collector uses remote updates.
Versionstringyes Short-TermThe version used.
wantedVersionstring  Short-TermThe wanted version.