I need a solution about how to count events in a time frame by using graylog api browser.
When I look for a count event option in graylog rest api browser ther is only one option;
In this option I can only choose a spesific stream, but I need events count in spesific time frame like last 30 minutes.
how can I querry this url by adding last 30 min time range?
This is a bit of a hack that I used for a similar thing in the past, not sure if there is a nicer way of doing it.
Use the, now legacy, relative search API with
range=1800. That way you will get the latest message and also some statistics, those are what you are looking for. In a bash one liner it would be this:
curl -s -k -u admin:password -H 'X-Requested-By: cli' "https://GRAYLOG_IP_OR_HOSTNAME/api/search/universal/relative?query=*&limit=1&range=1800&sort=timestamp:desc&pretty=true" -H "Accept: application/jsn" -H "Content-Type: application/json" | jq '.total_results'
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.