API: ingestion, import, and maintenance

Endpoints that control what gets indexed, trigger imports, rebuild the index, and clean up. All are selected with ?api=<action>, and all follow the shared auth and header rules.

Ingestion settings - api=ingestion-settings

Controls which severities are indexed.

Method	Behavior
GET	Returns available_severities, ingested_severities, and defaults.
POST / PUT / PATCH	Body {"severities": [...]}. Returns the updated configuration.

Levels are EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG; a new workspace defaults to ERROR + WARNING. Values are uppercased and deduplicated; an unknown level or an empty list returns 422. Only events at an indexed severity are stored. See Choose which severities to index.

Import incoming - api=import-incoming (POST)

Discovers .log files in the incoming directory, indexes new bytes, moves each file into processed/, then prunes the archive. Returns per-run counts:

{ "files": 3, "events": 120, "groups": 8, "skipped": 1,
  "processed": 3, "ingested_severities": ["ERROR","WARNING"],
  "by_type": {"laravel": 120}, "errors": [], "retention": {...} }

Only one incoming import runs per application at a time; a concurrent call returns 400. Unchanged files are skipped.

Reindex - api=reindex (POST)

Resets every known source file's offset and parser version, then reparses all files that still exist on disk. Use it after changing indexed severities or upgrading the parser. Returns the same count shape as import. See Reindex after changing settings.

Delete indexed logs - api=delete-logs (POST)

Removes indexed occurrences within one scope. Always send confirmation, plus exactly one scope field:

Field	Required	Meaning
confirmation	Always	Must equal DELETE LOGS
date	One scope	YYYY-MM-DD day of occurrence
source_id	One scope	A single source file

Supplying both scopes, neither, or the wrong confirmation returns 422. Group counts are recomputed and empty ingested groups are removed; raw archived files and checkpoints are preserved. Preview first with GET api=log-deletion-preview (date / source_id query params). See Delete indexed logs by date or source.

Processed retention - api=processed-retention

Method	Behavior
GET	Returns the active policy and archive size (archived_files, archived_bytes).
POST	Prunes now; returns status and pruned.

Policy comes from retention.processed_max_age_days and retention.processed_max_files (both 0 = disabled). Pruning keeps the newest files and only removes raw archived files, never indexed issues. See Prune the processed archive.