# Query Message ID with REST API

**URL:** <https://community.graylog.org/t/query-message-id-with-rest-api/21846>\
**Category:** Development\
**Created:** [November 24, 2021, 11:55am UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846 "2021-11-24T11:55:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mleibold](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mleibold/32/10224_2.png) [@mleibold](https://community.graylog.org/u/mleibold)\
**Post date:** [November 24, 2021, 11:55am UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846/1 "2021-11-24T11:55:03Z")

</div>

I am trying to query Log messages from Graylog via their REST API. The query I am currently using looks like the following:

```python
header = {"X-Requested-By": "OS-AD", "Content-Type": "application/json", "Accept": "text/csv"}
query = {
    "query_string": {"type": "elasticsearch", "query_string": "*"},
    "streams": ["61406557e62e6244b6bbded5"],
    "timerange": {
        "type": "absolute",
                "from": start,
                "to": end
    }
}

```

It is implemented in python, that’s why the API call is split up into two different dictionaries, but I think you get the point.  
From this I just get back a response in csv format (as expected so far) with three columns: “timestamp”, “source” and “message”. Although in Graylog itself I see some other parameters like level, facility\_num and facility and a individual message id. I think the message id is also often referred to as a permalink.  
It is also the most important one to me, since it would help me a lot with further processing of the logs, the other ones are a nice extra but I don’t really need them.  
Is there any way to change my query so that it also returns me the other parameters, more specifically the message id?  
I really couldn’t pull much information from the API docs, since they are quite cryptic for me…

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [November 24, 2021, 11:48pm UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846/2 "2021-11-24T23:48:39Z")

</div>

Hello,  
I’ll be honest, I have not played with APIs that much but what I do know on the messaged ID tip, I’m using this field **gl2\_message\_id** to get what I want.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d2a7e208a02e672279a2aaee070ea391c7798a59.png)

---

<div class="post-metadata">

**Author:** ![mleibold](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mleibold/32/10224_2.png) [@mleibold](https://community.graylog.org/u/mleibold)\
**Post date:** [November 25, 2021, 11:26am UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846/3 "2021-11-25T11:26:59Z")

</div>

Hi,

Thanks a lot for your answer!  
This is already very helpful, although I am not sure how I can query exact fields from the API.  
For now I am just using the /view/search/messages endpoint, which (for some reason) only exports a few fields to csv.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [November 26, 2021, 6:03am UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846/4 "2021-11-26T06:03:21Z")

</div>

Not sure if this will help ,but have you tried the API browser? This is under System/Nodes.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7b8925b8a054572e14d04a3bbb43b55c14855b09.png)

Perhaps that will give you more insight.

---

<div class="post-metadata">

**Author:** ![mleibold](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mleibold/32/10224_2.png) [@mleibold](https://community.graylog.org/u/mleibold)\
**Post date:** [November 26, 2021, 10:51am UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846/5 "2021-11-26T10:51:40Z")

</div>

Yes, I already took a look at that. It is also what basically everyone recommends, but I do not really understand the format of the API calls, which is maybe just due to some formatting mistakes on my side. At the moment I am also having Authorization problems, so I need to wait for the admin anyway, but thanks a lot for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 10, 2021, 10:52am UTC](https://community.graylog.org/t/query-message-id-with-rest-api/21846/6 "2021-12-10T10:52:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.