If you constrain your API call to the All Messages Stream, what do you get? - I have little experience with the API but based on Jan Doberstein’s post here, it seems you could add the stream as below…
curl -i -X POST \
-u 'EventReader:TQlCyGdrrlWuhNVy2sKM' \
-H 'Content-Type: application/json' \
-H 'Accept: text/csv' \
-H 'X-Requested-By: cli' \
'http://graylog.xxx.xxx:9000/api/views/search/messages' -d \
'{
"streams": [
"<stream-ID-Here>"
],
"timerange": [
"absolute",{
"from": "2021-12-22T00:00:00.000Z",
"to": "2021-12-23T18:55:00.000Z"
}
],
"fields_in_order": [
"timestamp",
"ObjectName",
"SubjectUserName"
]
}'