How to do aggregation by API in 4.x

[bks]

Description of your problem

Get a better understanding of how to use View-API (/view/*) that can be seen in the next picture
I have not found a detailed documentation about the API, therefore I am unsure how to use.

How API was used in Version 3.3

In Graylog Version 3.3, I am using legacy aggregation api that is depracted in 4.x
https://docs.graylog.org/en/3.3/pages/upgrade/graylog-3.3.html#deprecating-legacy-aggregation-api-endpoints

It is usful to automate and pull satistics based on certain fields, e. g. “counts for fieldname srccountry”
See my following example.

```
curl -X GET  "https://graylog.net:9000/api/search/universal/relative/terms?field=srccountry&query=streams%3A5c6feab5e3ef56000b1456fb&range=3600" | json_pp


   "terms" : {
      "Bosnia and Herzegovina" : 1,
      "Indonesia" : 1,
      "Germany" : 22,
      "Ireland" : 5,
      "Luxembourg" : 2,
      "Singapore" : 6,
      "Denmark" : 3,
      "Lithuania" : 1,
      "Korea, Republic of" : 1,
      "Russian Federation" : 38,
      "Brazil" : 1,
      "Hong Kong" : 3,
      "Romania" : 1,
      "Egypt" : 1,
      "Switzerland" : 1,
      "United Kingdom" : 8,
      "China" : 52,
      "United States" : 89,
      "Ukraine" : 85,
      "Bulgaria" : 2,
      "Netherlands" : 40,
      "Canada" : 1,
      "Reserved" : 1,
      "Chile" : 1,
      "Japan" : 6,
      "France" : 1
   }
```

Can anyone help, explain or provide an example how to use 4.x API to build my example from deprecated/legacy 3.3 API?

Many, many thanks!

[gsmith]

Hello,
To help us, help you better we would need some more information. Check out this post for a better understanding .

How to Post a Question in the Community that Gets Responses

This platform is made with love for community discussions on the open source tool Graylog, it components and usage. Here’s a Graylog support-inspired template (thank you, @aaronsachs ) that’ll get responses: Description of your problem <!-- Use this section to describe the problem that you're encountering. Please include any screenshots or recordings of the problem you're running into.--> Description of steps you’ve taken to attempt to solve the issue <!-- Use this section to provide detail…

Perhaps something in this post might help

How to search messages using REST API

I am trying to use REST API for searching through messages. I need to search message containing some string. I followed the document, created the token and able to access APIs. [apis] I dont know how exactly use this APIs. Should I need to create query first or something else? Can someone give me example endpoint so that I can search messages with any string.

Graylog4 rest api search export

he search via API is different in 4.0 and the documentation lacks behind … The “best” way currently is to use the export API: ## Search via Export API curl -X "POST" "https://graylog/api/views/search/messages" \ -H 'X-Requested-By: Mamamia' \ -H 'Content-Type: application/json' \ -H 'Accept: text/csv' \ -u 'USER:PASSWORD' \ -d $'{ "streams": [ "5e569003c793163fea1b3373" ], "query_string": { "type": "elasticsearch", "query_string": "section:boulder" …

[bks]

Hi gsmith,

thanks for your feedback.

1. I’ll do better if posting a problem the next time!
2. Your hints have been helpfull. I managed to used API endpoint /views/search/sync

Many thanks