In this option I can only choose a spesific stream, but I need events count in spesific time frame like last 30 minutes.
how can I querry this url by adding last 30 min time range? https://graylog.***.com:443/api/count/5a9014c6abd9bf096aff683a/total
This is a bit of a hack that I used for a similar thing in the past, not sure if there is a nicer way of doing it.
Use the, now legacy, relative search API with query=*, limit=1 and range=1800. That way you will get the latest message and also some statistics, those are what you are looking for. In a bash one liner it would be this: curl -s -k -u admin:password -H 'X-Requested-By: cli' "https://GRAYLOG_IP_OR_HOSTNAME/api/search/universal/relative?query=*&limit=1&range=1800&sort=timestamp:desc&pretty=true" -H "Accept: application/jsn" -H "Content-Type: application/json" | jq '.total_results'