API "since" date in relative form?

1. Describe your incident:
I am attempting to monitor graylog’s indexer failures automatically, but the API requires a “since” field with an ISO8601 date, which does not support relative formats.
This is extremely frustrating as I now have to calculate relative dates myself to get failures over the past 1 hour, 6 hours, 24 hours, ect.
I could create a script that the my monitor would run, but thats an annoying and unnecessary fix.

Is there anyway to pass a relative date, like -1d or something to this API?
You’d think since the search supports relative dates, the API would too…

2. Describe your environment:

  • OS Information: Debian 12 AMD64
  • Package Version: Graylog 6.0.7

Can you share what API endpoint you are using?

I also recommend checking out the api browser via /api/api-browser/ and looking at the Search/Simple API endpoints

I am using /system/indexer/failures/count
Which requires its since parameter value to be an ISO8601 date, which does not support relative time.

Unless there is another API enpoint that can retrieve indexer failure count?

Understood. I forget that using the Processing and Indexing Failures stream/feature requires an active enterprise license. I don’t think there is any other way to query what you need without a license.

Ah, dang. I guess this might be a feature request then.
since date requirement is very restricting.