Sign in
preview

Capture live incoming data

Initiate a live data capture from Cribl Workers.Returns a stream of captured events in NDJSON format that match the parameters specified in the request body.

post/system/capture

Request body

durationnumber required

Amount of time to keep capture open, in seconds.

filterstring required

JavaScript expression evaluated against each event to determine whether an event is included in the capture output. Expressions can reference any event field and use logical operators.

level0 | 1 | 2 | 3 required

Stage at which events are captured. <br><code>0</code> == Before pre-processing Pipeline <br><code>1</code> == Before the Routes <br><code>2</code> == Before post-processing Pipeline <br><code>3</code> == Before the Destination.

maxEventsinteger required

Maximum number of events to capture.

stepDurationinteger

How long to wait before increasing the capture sample size. Specify <code>1</code> second or longer.

workerIdstring

Unique ID of the Worker.

workerThresholdinteger

Maximum number of Workers that can capture initially. A value of <code>0</code> means unlimited (all available Workers can capture).

Response

CapturedEvent object

Changes