CRcriblio
preview

Capture live data

Changed on

Initiate a live data capture from Cribl Workers. Returns a stream of captured events in NDJSON format that match the parameters specified in the request body.

post/system/capture

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • Auth
    • HTTP bearer
    • or OAuth 2
      Client credentials
      Token URL: https://login.cribl.cloud/oauth/token

Request body

durationinteger

Amount of time to keep capture open, in seconds. If not provided, the default is 5 seconds.

filterstring

JavaScript expression evaluated against each event to determine whether an event is included in the capture output. Expressions can reference any event field and use logical operators. If not provided, all events are captured.

level0 | 1 | 2 | 3

Stage at which events are captured. <br><code>0</code> == Before pre-processing Pipeline <br><code>1</code> == Before the Routes <br><code>2</code> == Before post-processing Pipeline <br><code>3</code> == Before the Destination.

maxEventsinteger

Maximum number of events to capture. If not provided, the default is 100.

stepDurationinteger

How long to wait before increasing the capture sample size. Specify <code>1</code> second or longer. If not provided, the default is 5 seconds.

workerIdstring

Unique ID of the Worker.

workerThresholdinteger

Maximum number of Workers that can capture initially. A value of <code>0</code> means unlimited (all available Workers can capture). If not provided, the default is 50.

Response

Stream of captured events.

Changes

  • e9bef570d106Revision changes
    • info

      added the media type application/json for the response with the status

    • info

      added the optional property to the response with the status

    • info

      the response property became required for the status

    • info

      added the required property to the response with the status

  • 484cda0ad459Revision changes
    • breaking

      the request property type changed from number to integer

    • warning

      the request property's max was set to 3.00

    • warning

      the request property's max was set to 10000.00

    • warning

      the request property's min was set to 1.00

    • warning

      the request property's min was set to 0.00

    • warning

      the request property's min was set to 1.00

    • info

      the request property became optional

    • info

      the request property became optional

    • info

      the request property became optional

    • info

      the request property became optional

    • info

      added the non-success response with the status