Any hint for using dashboards or Saved searches through API in Graylog 3.3

Graylog Central (peer support)
1

I dont often USE graylog REST API. I know I can call it ant get for example some configuration parameter.
Now I would like to use API to present the existnig dashboard or saved search. I know they can be found under Legacy department of API browser.
It seems I miss basic concept of how can I reuse the Dashboard or Saved search. I can get the dashboard ID or widget ID, but which API call to use te get some walues outside of those Dashboard/searcheds ?

For example:
If I have a simple dashboard where I have a simple table with 15 hostnames listed in column1 und in column 2 the number of times each host was found, how can I use API to export this data. Can I use API to get list of all hostnames in column 1 and list of values in column 2 ?

I am using OPen Graylog version 3.3.16, it is installed on Centos server.

2

Hello,

By chance have you looked in the API browser?

image
image1869×315 32.5 KB

This maybe a little confusing but check under VIEWS in the API Browser.

image
image965×886 27.3 KB

As you can see I can get info from my widgets as shown below, This was under VIEWS in the API browser.

image
image1118×851 39.2 KB

Hope that helps

1 Like
3

gsmith thank you for your answer. Yes I was browsing and trying API browser a lot, I saw that you can get dashboard IDs and widget ID.
My problem is I have very little API experience and my quesiton is what can I do outside of graylog -
in API once API returns me all those widget names and their IDs like in your example:
“Windows failed logons”, "count by SourceModule, “Sucesful Logon”


Is reference to widget ID enought that it will somehow “draw” the widget on some new webpage
I guess much more info is neede for that to succeed?

BTW, in I found some other API call, that returns values of histogram without need for any widget ID.
In the example bellow I use simple query to find all strings of “unknown”. This helps somwhat for my case. Just I have to tinker how to put more complex querys that would equal complex views in such query.

curl  -H 'Accept: application/json' -X GET "https://<graylog>/api/search/universal/relative/histogram?query=unknown&interval=minute&range=600&streams=59f1c8a2fb1f6820b4c78bc4&pretty=true"
{
"interval" : "minute",
"results" :

{ "1642180920" : 17, "1642180980" : 251, "1642181040" : 389, "1642181100" : 352, "1642181160" : 420, "1642181220" : 467, "1642181280" : 497, "1642181340" : 481, "1642181400" : 677, "1642181460" : 441, "1642181520" : 524 }
4

Hello,
I also don’t have that much experience with GL API. Graylog Dashboard is good enough for us so I don’t have to export data around to other web sites, BUT I do use Prometheus enabled on Graylog /w Grafana for metrics.

https://docs.graylog.org/docs/metrics

Can I ask what your trying do do with Graylog’s API?

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.