Summary

The getLogCollectorDetails() GraphQL query returns runtime details for a Log Collector instance, including its identity, host information, active log sources, applied configurations, resource metrics, and recent errors.

API Stability Short-Term

Syntax

graphql
getLogCollectorDetails(
      machineId: String,
      id: String,
      isLive: Boolean = true
   ): LogCollectorDetails

All three inputs are optional. Provide id (the enrollment ID) or machineId (the machine identifier) to target a specific collector. Set isLive to false to query cached data instead of requesting a live response from the collector; it defaults to true. See Input Parameters and Returned Values for details.

Example

Raw
graphql
query {
  getLogCollectorDetails(machineId: "123")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  getLogCollectorDetails(machineId: \"123\")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  getLogCollectorDetails(machineId: \"123\")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  getLogCollectorDetails(machineId: \"123\") ^
     {id, hostname, ipAddress, ^
      configurations {id, name, assignment} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  getLogCollectorDetails(machineId: \"123\")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  getLogCollectorDetails(machineId: \"123\")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  getLogCollectorDetails(machineId: \"123\")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  getLogCollectorDetails(machineId: \"123\")
     {id, hostname, ipAddress,
      configurations {id, name, assignment} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

All three inputs are optional. Provide id (the enrollment ID) or machineId (the machine identifier) to target a specific collector. Set isLive to false to query cached data instead of requesting a live response from the collector; it defaults to true.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this query.
id String     The unique identifier of a Log Collector.
isLive Boolean   true Whether to include results from a live log.
machineId String     The server's identifier.

Returned Values

Returns a nullable LogCollectorDetails object. Identity fields include id (nullable — only set if the collector is enrolled), hostname, machineId, ipAddress (nullable), system (the host OS), and version. Operational fields include status (a nullable LogCollectorStatusType), lastActivity, logSources (active log sources), configurations (applied LogCollectorConfigInfo objects), errors (a list of error strings), and labels. Resource metrics over the preceding 5 minutes include cpuAverage5Min, memoryMax5Min, and diskMax5Min (all nullable). ingestLast24H reports total ingest volume in the last 24 hours. ephemeralTimeout (nullable) indicates the timeout for ephemeral collector sessions. The available fields are listed here:

Table: LogCollectorDetails Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
configurationsLogCollectorConfigInfoyes Short-Term The log collector configurations. See LogCollectorConfigInfo.
cpuAverage5MinFloat  Short-Term The CPU average for a five minute period.
diskMax5MinFloat  Short-Term The disk maximum for a five minute period.
ephemeralTimeoutInt  Short-Term The ephemeral timeout in milliseconds.
errorsStringyes Short-Term The errors.
hostnameStringyes Short-Term The hostname.
idString  Short-Term The unique identifier of the collector, if enrolled.
ingestLast24HLong  Short-Term The ingest for the previous twenty-four hours.
ipAddressString  Short-Term The IP address.
labelsLogCollectorLabelyes Short-Term Log collector labels. See LogCollectorLabel.
lastActivityStringyes Short-Term The last activity recorded.
logSourcesLogCollectorLogSourceyes Short-Term The log collector's log source. See LogCollectorLogSource.
machineIdStringyes Short-Term The log collector's machine unique identifier.
memoryMax5MinLong  Short-Term The maximum memory usage for a five minute period.
statusLogCollectorStatusType  Short-Term The status of the log collector. See LogCollectorStatusType.
systemStringyes Short-Term The host system.
versionStringyes Short-Term The version.