Any hint for using dashboards or Saved searches through API in Graylog 3.3

Graylog Central (peer support)
1

I dont often USE graylog REST API. I know I can call it ant get for example some configuration parameter.
Now I would like to use API to present the existnig dashboard or saved search. I know they can be found under Legacy department of API browser.
It seems I miss basic concept of how can I reuse the Dashboard or Saved search. I can get the dashboard ID or widget ID, but which API call to use te get some walues outside of those Dashboard/searcheds ?

For example:
If I have a simple dashboard where I have a simple table with 15 hostnames listed in column1 und in column 2 the number of times each host was found, how can I use API to export this data. Can I use API to get list of all hostnames in column 1 and list of values in column 2 ?

I am using OPen Graylog version 3.3.16, it is installed on Centos server.

2

Hello,

By chance have you looked in the API browser?

image
image1869Ă—315 32.5 KB

This maybe a little confusing but check under VIEWS in the API Browser.

image
image965Ă—886 27.3 KB

As you can see I can get info from my widgets as shown below, This was under VIEWS in the API browser.

image
image1118Ă—851 39.2 KB

Hope that helps

1 Like
3

gsmith thank you for your answer. Yes I was browsing and trying API browser a lot, I saw that you can get dashboard IDs and widget ID.
My problem is I have very little API experience and my quesiton is what can I do outside of graylog -
in API once API returns me all those widget names and their IDs like in your example:
“Windows failed logons”, "count by SourceModule, “Sucesful Logon”…

Is reference to widget ID enought that it will somehow “draw” the widget on some new webpage…I guess much more info is neede for that to succeed?

BTW, in I found some other API call, that returns values of histogram without need for any widget ID.
In the example bellow I use simple query to find all strings of “unknown”. This helps somwhat for my case. Just I have to tinker how to put more complex querys that would equal complex views in such query.

curl  -H 'Accept: application/json' -X GET "https://<graylog>/api/search/universal/relative/histogram?query=unknown&interval=minute&range=600&streams=59f1c8a2fb1f6820b4c78bc4&pretty=true"
{
"interval" : "minute",
"results" :

{ "1642180920" : 17, "1642180980" : 251, "1642181040" : 389, "1642181100" : 352, "1642181160" : 420, "1642181220" : 467, "1642181280" : 497, "1642181340" : 481, "1642181400" : 677, "1642181460" : 441, "1642181520" : 524 }
4

Hello,
I also don’t have that much experience with GL API. Graylog Dashboard is good enough for us so I don’t have to export data around to other web sites, BUT I do use Prometheus enabled on Graylog /w Grafana for metrics.

https://docs.graylog.org/docs/metrics

Can I ask what your trying do do with Graylog’s API?

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.