# \[API\] - Legacy search

**URL:** <https://community.graylog.org/t/api-legacy-search/31719>\
**Category:** Graylog Central (peer support)\
**Created:** [March 6, 2024, 1:19pm UTC](https://community.graylog.org/t/api-legacy-search/31719 "2024-03-06T13:19:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gabao-Farias](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gabao-farias/32/16366_2.png) [@Gabao-Farias](https://community.graylog.org/u/Gabao-Farias)\
**Post date:** [March 6, 2024, 1:19pm UTC](https://community.graylog.org/t/api-legacy-search/31719/1 "2024-03-06T13:19:01Z")

</div>

Hi guys!

Quick question here…

I was testing successfully the Graylog (5.2.4) APIs but I’ve seen that there is a **“Legacy”** term on those…

So I want to know if this is just the currently default way to query for messages or if there is an “updated” way to do that?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/f/7/f7857fcff5492a273c4de038e4adb5be0136f1fc.png)

By the way… I’m using `search/universal/relative` for those queries…

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [March 6, 2024, 1:39pm UTC](https://community.graylog.org/t/api-legacy-search/31719/2 "2024-03-06T13:39:58Z")

</div>

What kind of query are you trying to do, because there is the simple search query now that is very easy for basic things.

---

<div class="post-metadata">

**Author:** ![Gabao-Farias](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gabao-farias/32/16366_2.png) [@Gabao-Farias](https://community.graylog.org/u/Gabao-Farias)\
**Post date:** [March 6, 2024, 1:56pm UTC](https://community.graylog.org/t/api-legacy-search/31719/3 "2024-03-06T13:56:32Z")

</div>

I’m just querying for messages that are retrieved by the server’s sidecars and stored in the Elasticsearch, my objective would be make the same queries that I can make on the Search tab in the Graylog site, in the API.

As an example I’m making this API call…

`http://localhost:9000/api/search/universal/relative?query=filebeat_log_file_path:"/var/log/mail_logs" AND message:"some@domain.name"&range=86400&fields=message,source,filebeat_log_file_path&limit=`

```auto
http://localhost:9000/api/search/universal/relative?query=filebeat_log_file_path:"/var/log/mail_logs" AND message:"some@domain.name"&range=86400&fields=message,source,filebeat_log_file_path&limit=

```

The equivalent to that in the Graylog’s Search tab would be…

```auto
filebeat_log_file_path:"/var/log/mail_logs" AND message:"some@domain.name"

```

But again… the API is already working fine, I just wanted to understand if that **“Legacy”** term is saying that this endpoint is deprecated or something like that… 🤔

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/f/e/fede5986d86c981c9a08752804283d60bbcbbf21.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 20, 2024, 1:56pm UTC](https://community.graylog.org/t/api-legacy-search/31719/4 "2024-03-20T13:56:45Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.