Exporting logs out of loganalaysis ibm cloud

Question

Is there a way to export logs out of IBM Cloud? Mainly activity logs which come from Activity Tracker. Also, does anyone know where these logs are stored? I can only view them inside Kibana but dont see any storage associated with it.

I tried

ibmcloud logging log-show but it errors out as: 
read: connection reset by peer

Answer 1

First of all, you must choose a premium plan to make API calls and export the logs from Activity Tracker

Once you create the Activity Tracker service, you can use the CLI to export the logs by creating a session

ibmcloud at session help create                                                                                                           
NAME:
   bx at session create - Create a new session
USAGE:
   bx at session create [command options] [arguments...]

OPTIONS:
   --start value, -s value        start date, in format 2006-01-02 (default: "2018-11-09")
   --end value, -e value          end date, in format 2006-01-02 (default: "2018-11-22")
   --at-account-level, -a         include entire account (default: current space only)
   -T value, --search-time value  Specify search time with the hour of one day, the valid value is 0-23
   --json                         output in JSON format

Eg., ibmcloud at session create -s 2018-11-21 -e 2018-11-22 --json

Once the session is created, it returns a session id.

You can download the logs using this command

ibmcloud at download -o events.log <SESSION_ID>

For more details on downloading the events, refer this link

You can also make a REST API call to download the events

Update: Reading through the documentation in-depth, I found out where the data is stored.

The Activity Tracker service includes 2 data repositories where your event data is stored:

One repository where event data is available for analysis through Kibana. The standard or lite plan only stores data in this repository. Data is kept for 3 days.

One long-term storage repository that hosts the event data for the premium plan. Event data is stored until you either configure a retention policy or delete them manually. By default, events are kept indefinitely.

The storage is encrypted. Also, to configure the retention policy read this link