---
title: "Capture live data"
method: POST
path: "/system/capture"
tags: ["preview"]
---

# Capture live data

`POST /system/capture`

Initiate a live data capture from Cribl Workers. Returns a stream of captured events in NDJSON format that match the parameters specified in the request body.

## Request body

- CaptureParamsReq
  - `duration` integer — Amount of time to keep capture open, in seconds. If not provided, the default is 5 seconds.
  - `filter` string — JavaScript expression evaluated against each event to determine whether an event is included in the capture output. Expressions can reference any event field and use logical operators. If not provided, all events are captured.
  - `level` 0 | 1 | 2 | 3 — Stage at which events are captured. <br><code>0</code> == Before pre-processing Pipeline <br><code>1</code> == Before the Routes <br><code>2</code> == Before post-processing Pipeline <br><code>3</code> == Before the Destination.
  - `maxEvents` integer — Maximum number of events to capture. If not provided, the default is 100.
  - `stepDuration` integer — How long to wait before increasing the capture sample size. Specify <code>1</code> second or longer. If not provided, the default is 5 seconds.
  - `workerId` string — Unique ID of the Worker.
  - `workerThreshold` integer — Maximum number of Workers that can capture initially. A value of <code>0</code> means unlimited (all available Workers can capture). If not provided, the default is 50.

## Response `200`

Stream of captured events.

## Other responses

- `400` — Failed validation or malformed input — No worker nodes are connected to this worker group.
- `401` — Authentication failed (missing or invalid credentials or Bearer token).
- `500` — Unexpected server error.

---

[API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/56cb25079271/schema)