Querying Aria Operations for Logs API by Hostname – A Complete Guide

If you need to pull log events programmatically from VMware Aria Operations for Logs (formerly vRealize Log Insight), filtering by a specific hostname, this guide walks you through the entire process — from authentication to querying the powerful internal API endpoint.

This approach is inspired by Brock Peterson’s excellent series on the Aria Operations for Logs API, expanded here with full session authentication steps and hostname-specific query examples.

Prerequisites

Before we begin, you’ll need:

Aria Operations for Logs deployed and accessible (FQDN or IP)
A local admin account or Active Directory / vIDM credentials
curl installed on your workstation
Access to port 9543 on the Aria Operations for Logs appliance

Note: All examples use the -k flag to skip SSL certificate verification. In production, you should use proper certificate trust chains instead.

Step 1: Authenticate and Retrieve a Session Token

Every API interaction starts with obtaining a Bearer token. You do this by posting your credentials to the /api/v2/sessions endpoint.

Local Authentication

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN:9543/api/v2/sessions" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "YourPasswordHere",
    "provider": "Local"
  }'

Active Directory Authentication

If your environment uses Active Directory, change the provider value:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN:9543/api/v2/sessions" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "your_ad_user",
    "password": "YourPasswordHere",
    "provider": "ActiveDirectory"
  }'

vIDM (Workspace ONE Access) Authentication

For federated identity via vIDM:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN:9543/api/v2/sessions" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "user@domain.com",
    "password": "YourPasswordHere",
    "provider": "vIDM"
  }'

Understanding the Response

All three methods return the same JSON structure:

{
  "userId": "3c1b81cc-418e-44c0-b91a-54e10a87b1d3",
  "sessionId": "1a2b3c4d-your-session-token-here==",
  "ttl": 1800
}

Field	Description
`userId`	Unique identifier for the authenticated user
`sessionId`	This is your Bearer token — save it for all subsequent API calls
`ttl`	Token time-to-live in seconds (default: 1800 = 30 minutes)

Copy the sessionId value — this is the Bearer token you’ll use in every subsequent request.

Step 2: Verify Your Session (Optional)

Before running queries, you can verify your token is valid:

curl -k "https://YOUR_LOG_INSIGHT_FQDN:9543/api/v2/sessions/current" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE"

A successful response confirms your session is active and returns your user details.

Step 3: Discover the Internal API

The standard /api/v2/events endpoint works but is unintuitive and poorly documented. The internal API is far more powerful and flexible.

You can browse the internal API documentation at:

https://YOUR_LOG_INSIGHT_FQDN/rest-api/internal

Scroll down to the events section and you’ll find POST /events/query — this is the endpoint we’ll use for all our hostname queries.

Step 4: Query Events by Hostname

Now for the main event. The internal POST /events/query endpoint accepts a JSON body with a constraints field that uses the same query language as the Explore Logs UI.

Basic Hostname Query (Last 5 Minutes)

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"esxi01.lab.local\" & LastFiveMinutes",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }'

Hostname Query (Last 24 Hours)

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"esxi01.lab.local\" & LastDay",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }'

Hostname + Text Search

Search for the word “error” on a specific host:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"esxi01.lab.local\" & '\''error'\'' & LastDay",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }'

Multiple Hostnames with OR

Query logs from two different hosts simultaneously:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "(hostname:\"esxi01.lab.local\" | hostname:\"esxi02.lab.local\") & LastDay",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }'

Hostname + Specific Field Exists

Find vCenter events logged from a specific host:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"vcsa01.lab.local\" & EXISTS(vc_event_type) & LastDay",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }'

Hostname + Specific Field Value

Filter a host for specific vCenter event types (e.g., user login events):

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"vcsa01.lab.local\" & vc_event_type:\"com.vmware.vim25.userloginsessionevent\" & Last48",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 20000,
    "timeout": 30000
  }'

Hostname + Epoch Timestamp Range

For precise time ranges, use seconds-since-epoch timestamps:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"esxi01.lab.local\" & (timestamp > 1743552000 & timestamp < 1743638400)",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }'

Tip: Use a tool like epochconverter.com to convert human-readable dates to epoch timestamps.

Hostname with Aggregation (Event Count by Type)

Get a count of events grouped by type for a specific host:

curl -k -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer YOUR_SESSION_ID_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"esxi01.lab.local\" & LastDay",
    "aggregations": "COUNT(event)",
    "groups": "event_type",
    "order": "event ASC",
    "resultsFrom": 1,
    "resultsTo": 20000,
    "timeout": 30000
  }'

Quick Reference: Constraint Syntax

Syntax	Description
`hostname:\"value\"`	Filter by exact hostname
`'text string'`	Search for text in log messages
`&`	AND operator
`\|`	OR operator
`EXISTS(field)`	Check if a field exists in the log entry
`field:\"value\"`	Filter by field value
`LastFiveMinutes`	Last 5 minutes of logs
`LastDay`	Last 24 hours
`Last48`	Last 48 hours
`timestamp > epoch`	Custom epoch-based time range

Quick Reference: Request Body Fields

Field	Description	Notes
`constraints`	Your query (filters, time range)	Required
`aggregations`	Aggregate function (e.g., `COUNT(event)`)	Leave empty for raw logs
`groups`	Group-by field	Leave empty for raw logs
`order`	Sort order for aggregations	Leave empty for raw logs
`resultsFrom`	Starting result index	Starts at 1
`resultsTo`	Ending result index	Maximum is 20,000
`timeout`	Query timeout in milliseconds	30000 = 30 seconds

Putting It All Together: A Complete Script

Here’s a one-liner that authenticates and queries in a single pipeline:

# Authenticate and store the token
TOKEN=$(curl -sk -X POST "https://YOUR_LOG_INSIGHT_FQDN:9543/api/v2/sessions" \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"YourPasswordHere","provider":"Local"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['sessionId'])")

# Query events for a specific hostname
curl -sk -X POST "https://YOUR_LOG_INSIGHT_FQDN/api/v1/events/query" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "constraints": "hostname:\"esxi01.lab.local\" & LastDay",
    "aggregations": "",
    "groups": "",
    "order": "",
    "resultsFrom": 1,
    "resultsTo": 500,
    "timeout": 30000
  }' | python3 -m json.tool

Important Notes

Field name verification: The hostname field is the standard syslog source field in Aria Operations for Logs. However, depending on your ingestion method and content packs, the field could be named source, vmw_esxi_hostname, or something custom. Check the field list in the Explore Logs UI sidebar to confirm.
Token expiration: The default TTL is 30 minutes (1800 seconds). For longer-running scripts, re-authenticate periodically.
Result limits: The maximum value for resultsTo is 20,000. For larger result sets, use the UI export-to-NFS feature as described in Brock Peterson’s export guide.
Internal API caveat: The POST /events/query endpoint is part of the internal API surface. While it’s far more powerful than the public /api/v2/events endpoint, internal APIs may change between versions without notice.

Prerequisites#

Step 1: Authenticate and Retrieve a Session Token#

Local Authentication#

Active Directory Authentication#

vIDM (Workspace ONE Access) Authentication#

Understanding the Response#

Step 2: Verify Your Session (Optional)#

Step 3: Discover the Internal API#

Step 4: Query Events by Hostname#

Basic Hostname Query (Last 5 Minutes)#

Hostname Query (Last 24 Hours)#

Hostname + Text Search#

Multiple Hostnames with OR#

Hostname + Specific Field Exists#

Hostname + Specific Field Value#

Hostname + Epoch Timestamp Range#

Hostname with Aggregation (Event Count by Type)#

Quick Reference: Constraint Syntax#

Quick Reference: Request Body Fields#

Putting It All Together: A Complete Script#

Important Notes#