Is it possible to edit the default stream (all messages) via the rest api?

Graylog Central (peer support)
1

Is it possible to edit the default stream (all messages) via the rest api?

On the api browser, under PUT /streams/{streamId}, it always complains:
Response Code

400

Response Body

{
  "type": "ApiError",
  "message": "The default stream cannot be edited."
}

P.S. I am trying to edit the outputs for the “All messages” stream.

1 Like
2

No, that’s not possible.

But it’s possible to add outputs to the “All messages” stream via the Graylog REST API.

You can also manage outputs in the Graylog web interface via Streams/Manage outputs.

3

Thanks.
I have just tried this API:
POST /streams/{streamid}/output

with this json body:

        "outputs": [
        {
          "id": "xxxxxxx",
          "title": "Graylog",
          "type": "org.graylog2.outputs.GelfOutput",
          "configuration": {
            "protocol": "TCP",
            "hostname": "xxxxxx",
            "connect_timeout": 1000,
            "queue_size": 512,
            "reconnect_delay": 500,
            "port": 12345,
            "max_inflight_sends": 512,
            "tcp_no_delay": false,
            "tcp_keep_alive": false,
            "tls_trust_cert_chain": "",
            "tls_verification_enabled": false
          },
          "content_pack": null
        }
          ]

But I kept on getting this error:

    {
      "type": "ApiError",
      "message": "Can not deserialize instance of java.lang.String out of START_OBJECT token\n at [Source: org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream@ec457fb; line: 3, column: 1] (through reference chain: org.graylog2.rest.models.streams.outputs.requests.AddOutputRequest[\"outputs\"]->java.util.HashSet[0])"
    }

Do you have an example of the output json body?

Thanks.

4

You have to use the POST /system/outputs resource of the Graylog REST API.

create_output
create_output.png1937×1122 198 KB

5

I tried POST /system/outputs:

{ 
  "title": "test"
   "type": "org.graylog2.outputs.GelfOutput"
  "configuration":{ blah }
   "streams":["000000000000000000000001"]
}

However, it created the output (test) without associating it with the stream (“All messages”).

I have also tried POST /streams/000000000000000000000001/outputs (since it says “Associate outputs with a stream”, which is what I am trying to do), with this json body:

  {
"outputs":["xxxxxxxxxxxxxxxxxxxxx"]
}

Where “xxxxxxxxxx” is the ID of the output.

This returns:

  "type": "ApiError",
  "message": "IOException encountered while reading from a byte array input stream"
}

Could you advise what should be the content of:

{
outputs (array[string], optional)
}

The array of string doesn’t tell much about what is expected for the string.

Thanks!

6

This works for me:

# curl -u admin:admin -H 'Content-Type: application/json' -H 'Accept: application/json' --data-binary '{"title":"TEST","type":"org.graylog2.outputs.LoggingOutput","configuration":{"prefix":"My prefix: "}}' 'https://graylog-server.example.com:9000/api/system/outputs'
{"id":"59c2f3af00003e49d521000","title":"TEST","type":"org.graylog2.outputs.LoggingOutput","creator_user_id":"admin","created_at":"2017-09-20T23:03:11.008Z","configuration":{"prefix":"My prefix: "},"content_pack":null}

# curl -u admin:admin -H 'Content-Type: application/json' -H 'Accept: application/json' --data-binary '{"outputs":["59c2f3af00003e49d521000"]}' 'https://graylog-server.example.com:9000/api/streams/000000000000000000000001/outputs'
7

That works. Thank you!

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.