TEtenzir
Pipeline output

Read pipeline output

Changed on

Reads events from an existing pipeline output stream. By default, the endpoint uses long polling (timeout: 5s) and returns as soon as at least one event is available (min_events: 1).

post/serve

Request

Request body

serve_idstring required

The output stream identifier returned when the pipeline was launched.

continuation_tokenstring

The continuation token from the previous response. Omit this field for the initial request.

max_eventsinteger

The maximum number of events to return.

min_eventsinteger

The minimum number of events to wait for before returning.

timeoutstring

The maximum time to spend on the request. Reaching the timeout returns the available events and is not an error. The timeout must not be greater than 10 seconds.

schema'exact' | 'never' | 'name_and_type'

The schema representation to include in the response. Use never to omit definitions, or name_and_type to report each event's schema name and structural type ID with definitions indexed by type ID.

Example request

{
  "serve_id": "query-1",
  "continuation_token": "340ce2j",
  "max_events": 1024,
  "min_events": 1,
  "timeout": "200ms",
  "schema": "exact"
}

Response

Events are available, the timeout was reached, or the pipeline reached a terminal state.

next_continuation_tokenstring nullable required

The token to use when reading the next batch. The value is null when the pipeline reached a terminal state.

state'running' | 'completed' | 'failed' required

The pipeline state at the time of the request.

Example response

{
  "next_continuation_token": "340ce2j",
  "state": "running",
  "schemas": [
    {
      "schema_id": "c631d301e4b18f4",
      "definition": {
        "name": "tenzir.summarize",
        "kind": "record",
        "attributes": [],
        "state": {
          "fields": [
            {
              "name": "severity",
              "type": {
                "name": null,
                "kind": "string",
                "attributes": [],
                "state": null
              }
            },
            {
              "name": "pipeline_id",
              "type": {
                "name": null,
                "kind": "string",
                "attributes": [],
                "state": null
              }
            }
          ]
        }
      }
    }
  ],
  "events": [
    {
      "schema_id": "c631d301e4b18f4",
      "data": {
        "timestamp": "2023-04-26T12:00:00Z",
        "schema": "zeek.conn",
        "schema_id": "ab2371bas235f1",
        "events": 50
      }
    },
    {
      "schema_id": "c631d301e4b18f4",
      "data": {
        "timestamp": "2023-04-26T12:05:00Z",
        "schema": "suricata.dns",
        "schema_id": "cd4771bas235f1",
        "events": 50
      }
    }
  ]
}

Changes

  • 8d8743b1f7f2Revision changes
    • info

      added the new name_and_type enum value to the request property

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

  • 28cb75a25674Revision changes
    • breaking

      removed the enum value legacy of the request property

    • info

      the request property default value changed from legacy to exact