# Limiting fields in api call (graylog 4.2)

**URL:** https://community.graylog.org/t/limiting-fields-in-api-call-graylog-4-2/31866
**Category:** Graylog Central (peer support)
**Tags:** script, automation
**Created:** [March 20, 2024, 2:49pm UTC](https://community.graylog.org/t/limiting-fields-in-api-call-graylog-4-2/31866 "2024-03-20T14:49:04Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![AxisNL](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/axisnl/32/16470_2.png) [@AxisNL](https://community.graylog.org/u/AxisNL)
#### Post date: [March 20, 2024, 2:49pm UTC](https://community.graylog.org/t/limiting-fields-in-api-call-graylog-4-2/31866/1 "2024-03-20T14:49:04Z")

</div>

I want to run a nightly report and get stuff from the graylog api for that. My query works, but I get all 50 or so fields for these kind of messages, which is waaaay to much data. I only need the timestamp and one other field.

Any idea how I can select only the fields i need?

```auto
{
    "queries": [
        {
            "timerange": {
                "type": "relative",
                "from": 60
            },
            "filter": null,
            "query": {
                "type": "elasticsearch",
                "query_string": "winlogbeat_event_code:4624 AND winlogbeat_event_action:Logon"
            },
            "search_types": [
                {
                    "limit": 1,
                    "offset": 0,
                    "sort": [
                        {
                            "field": "timestamp",
                            "order": "DESC"
                        }
                    ],
                    "decorators": [],
                    "type": "messages",
                    "filter": null
                }
            ]
        }
    ],
    "parameters": []
}

```

But this returns ALL fields…

Running graylog 4.2 on ubuntu (for now, upgrade to 5.2 is in process)

---

<div class="post-metadata">

### Author: ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)
#### Post date: [March 21, 2024, 2:27am UTC](https://community.graylog.org/t/limiting-fields-in-api-call-graylog-4-2/31866/2 "2024-03-21T02:27:45Z")

</div>

In 5.2 there is a new api called simple search that will let you select the fields you want returned, and is overall very easy to use.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [April 4, 2024, 2:28am UTC](https://community.graylog.org/t/limiting-fields-in-api-call-graylog-4-2/31866/3 "2024-04-04T02:28:33Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.