Search API Endpoint - Good practices


I’m currently used to run automation with scripts making use of the following endpoints:

  • /search/universal/absolute
  • /search/universal/relative

Those endpoints are marked as Legacy so their usage should be avoided.

I could not find in the documentation any real close equivalent to both endpoints.

Does anyone know endpoints that should be used for executing searches ? The expected output is messages as result in json format as for the 2 endpoints mentionned below.

Hi, i want to second this question. We are running Graylog 5.2.2 and i haven’t found a valid alternative to the legacy flagged endpoints in the API Browser.

Searching the net, i found endpoint /api/views/search/messages, which does, what i want. But i found nothing about the status of this endpoint. Will it be continued? May i use it in my longrunning projects?

After all my question is: Which endpoint should i use for my queries, that is futureproof and well documented.
Kind regards

It’s a good question. I don’t have the answer.
I used /search/universal/relative but as I also noticed it’s deprecated so now I use /views/search/sync

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.