query
POST /api/query
Summary: Create and execute a new query
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| query | validate_only |
boolean | no | Only validate, skip query calculation |
Request Body
- Media type:
application/json
Type: GenericQuery
- Media type:
application/x-www-form-urlencoded
Type: GenericQuery
- Media type:
multipart/form-data
Type: GenericQuery
Responses
-
201 —
-
Media type:
application/json
Type: GenericQuery
GET /api/query/{qid}
Summary: Get results for existing query
Another page can be requested (except the first one) with "page" query parameter (this makes sense only for search query, other types don't support paging).
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | qid |
string | yes | |
| query | page |
integer | no | supported only for search query (SearchQuery) |
| query | page_size |
integer | no | Number of results per page (SearchQuery) |
| query | offset |
integer | no | Pagination offset (SearchQuery) |
| query | add_geoip_data |
boolean | no | Include GeoIP data in results '(TopNQuery, LastNQuery) |
| query | actions_hint |
boolean | no | Include action hints in results (SearchQuery) |
| query | add_trigger_data |
boolean | no | Include trigger data in results (SearchQuery) |
Responses
-
200 —
-
Media type:
application/json
Type: GenericQuery
GET /api/query/{qid}/export
Summary: Return query results as report in specified file format
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | qid |
string | yes | |
| query | ftype |
string | no | one of 'csv', 'xslx', 'docx', 'pdf' or 'json' (default), but not every query type supports all formats |
| query | timezone |
string | no | Timezone name for query time ranges |
| query | filename |
string | no | File name for exported query |
Responses
-
200 —
-
Media type:
application/*
Type: string
GET /api/query/{qid}/recalculate
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | qid |
string | yes |
Responses
-
200 —
-
Media type:
application/json
Type: GenericQuery
GET /api/query/{qid}/remove
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | qid |
string | yes |
Responses
-
200 —
-
Media type:
application/json
Type: GenericQuery
GET /api/query/{qid}/stop
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | qid |
string | yes |
Responses
-
200 —
-
Media type:
application/json
Type: GenericQuery
POST /api/query/{qid}/stop
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | qid |
string | yes |
Request Body
- Media type:
application/json
Type: GenericQuery
- Media type:
application/x-www-form-urlencoded
Type: GenericQuery
- Media type:
multipart/form-data
Type: GenericQuery
Responses
-
200 —
-
Media type:
application/json
Type: GenericQuery