Per-view event tallies for the events page tabs
Returns how many of your stored events came from each agent kind you have access to. Every view you can open is always present, at zero when you have none, so a caller never has to guess whether a missing key means zero or an error. Which views you have is set per account: every product is one an administrator enables for you individually. An account with no products enabled receives {}. Each number is what the events list for that view would actually show, not a raw row count: your monthly event quota and the bucket parameter narrow it exactly as they narrow the list, so a tab and the rows under it cannot disagree. Admins have no quota. /api/event_count/ remains the separate quota-period tally. Counting is O(rows) on your whole partition, so the result is cached per (account, scope, bucket, quota) and refreshed in the background: a repeat call is served instantly and may be up to a minute stale.
This is a read: a read-only API key may call it.
Request
- Base URL: https://eyalsec.com
- URL: https://eyalsec.com/api/event_view_counts/
- Auth: one of:
- API key in header X-API-Key
- API key in cookie __Host-es2session
Query parameters
Which suppression bucket to count, matching the events page's Show control: live (default, unsuppressed only), suppressed (suppressed only) or all. Any other value is a 400.
Restrict the tally to events whose scope key matches this value. The scope key is the page host for es-chromium, the sink's package for es-go, and the first token of the event's origin (for example a file path) for every other agent. Omit to count everything.
How scope is matched: is (exact), ends (suffix) or regex. There is no default: a scope sent without scope_mode is ignored. An unknown mode or an uncompilable regex is a 400.
Also count events with no extractable scope key. Default false.
Response
OK.
Changes
No recorded changes to this operation across all 1 revision of this API.