Query Message ID with the Graylog REST API

Question

I am trying to query Log messages from Graylog via their REST API. The query I am currently using looks like the following:

header = {"X-Requested-By": "OS-AD", "Content-Type": "application/json", "Accept": "text/csv"}
query = {
    "query_string": {"type": "elasticsearch", "query_string": "*"},
    "streams": ["61406557e62e6244b6bbded5"],
    "timerange": {
        "type": "absolute",
                "from": start,
                "to": end
    }
}

It is implemented in python, that's why the API call is split up into two different dictionaries, but I think you get the point. From this I just get back a response in csv format (as expected so far) with three columns: "timestamp", "source" and "message". Although in Graylog itself I see some other parameters like level, facility_num and facility and a individual message id. I think the message id is also often referred to as a permalink.
It is also the most important one to me, since it would help me a lot with further processing of the logs, the other ones are a nice extra but I don't really need them.
Is there any way to change my query so that it also returns me the other parameters, more specifically the message id?
I really couldn't pull much information from the API docs, since they are quite cryptic for me...

score 0 · Answer 1 · answered Dec 12 '21 at 12:15

Apparently, I was just using the wrong API Endpoint. The one I am using now, which returns me the message_id, is /api/search/universal/absolute. I set the "fields" parameter of the request to "gl2_message_id,timestamp,message".
My overall query looks like this in my Python script:

params = {
    "query": "*",
    "from": start.strftime(DATETIME_FORMAT),
    "to": end.strftime(DATETIME_FORMAT),
    "fields": "gl2_message_id,timestamp,message",
    "sort": "asc"
}

with this, I successfully get a csv file with the message id, the timestamp and the message as columns. My main problems were Authorization problems in this case, because I didn't have access to this Endpoint at first.
Link to the question I asked in the Graylog Community Forum:
https://community.graylog.org/t/query-message-id-with-rest-api

_{Posted on behalf of the question asker}

Query Message ID with the Graylog REST API

1 Answers1