---
title: "Capture live incoming data"
method: POST
path: "/system/capture"
tags: ["preview"]
---

# Capture live incoming data

`POST /system/capture`

Initiate a live data capture from Cribl Workers.Returns a stream of captured events in NDJSON format that match the parameters specified in the request body.

## Request body

- CaptureParams
  - `duration` number, required — Amount of time to keep capture open, in seconds.
  - `filter` string, required — JavaScript expression evaluated against each event to determine whether an event is included in the capture output. Expressions can reference any event field and use logical operators.
  - `level` 0 | 1 | 2 | 3, required — Stage at which events are captured. <br><code>0</code> == Before pre-processing Pipeline <br><code>1</code> == Before the Routes <br><code>2</code> == Before post-processing Pipeline <br><code>3</code> == Before the Destination.
  - `maxEvents` integer, required — Maximum number of events to capture.
  - `stepDuration` integer — How long to wait before increasing the capture sample size. Specify <code>1</code> second or longer.
  - `workerId` string — Unique ID of the Worker.
  - `workerThreshold` integer — Maximum number of Workers that can capture initially. A value of <code>0</code> means unlimited (all available Workers can capture).

## Response `200`

CapturedEvent object

## Other responses

- `401` — Unauthorized
- `500` — Unexpected error

## Changes

- **2026-03-06** `11df16b26c1d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/criblio/apis/cribl-api-reference/changes/system/capture/post.md)

---

[API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/11df16b26c1d/schema)