API Query all Fields

[brumi (Isaac)]

Hi, in older versions of Graylog the search/universal/relative API endpoint would return all fields by default. I’ve upgraded Graylog to 5.2 and am now using the new API endpoint for searching, api/search/messages. This endpoint requires specifying the fields. Is there a way to return all fields instead? The data I’m querying can have a dynamic number of fields so I’m unable to safely determine what fields to return. Or is there another endpoint that supports this?

Query being used:

https://domain.com/api/search/messages

Body:

{
	"timerange": {
    "type": "relative",
		"from": 300
  },
  "size": 50,
  "query": "tag:application",
  "sort_order": "Ascending"
}

[joe.gross]

I put your question to one of our developers and got the reply that we don’t support the exact use case you are asking about today.

However, you can use our search API like so:

The response is a bit verbose, but you’ll find all the fields you need

I hope this helps.

Chris