Running queries with the Query API
- Juan Tomás Alonso Nieto (Deactivated)
This article lists and describes the parameters you can use in Devo Query API query requests as well as the different response formats:
Remember that all API queries must be validated using one of the available authorization methods.
Query request
Add the following path to your endpoint to launch a query:
POST /query
Parameters
Parameter | Type | Description |
|
|---|---|---|---|
| String (header) | This is always |
|
| String (header) | Include this header if you want to use a token to authorize your request. When you use a token, only the See Authorizing Query API requests for more information. |
|
| String (header) | This is the Devo domain API key found in Administration → Credentials. |
|
| String (header) | HMAC SHA-256 using the API_SECRET to sign the concatenation of the api_key, body message and timestamp |
|
| String (header) | Timestamp in milliseconds. |
|
| String (body) | This is the query that you want to run, expressed in LINQ. To find the query's LINQ script, open the query in the Data Search area, then choose Query code editor from the toolbar. The body of the request must contain either the |
|
| String (body) | This is the ID of the query that you want to run. To find the query ID, open the query in the Data Search area, then choose Additional Tools → Current query → Get ID. The body of the request must contain either the |
|
| Number (body) | The start date as a UTC timestamp in seconds. See the Relative dates section below to learn more about this parameter. |
|
| Number (body) | The end date as a UTC timestamp in seconds. If this parameter is left out, the query will be continuous. See the Relative dates section below to learn more about this parameter. |
|
| Object (body) | This object contains the |
|
| String (body) | The format in which you want the response to be sent. The possible values are:
These response formats are fully described later in this article. When you indicate a response format other than |
|
| Object (body) | This object specifies where the response should be sent. If this object is left out of the request body, the response will be sent back to the request source. |
|
| String (body) | This is the type of system to which the response should be sent. The possible values are:
Depending on the |
|
| List (body) | Destination parameters, depend on the |
|
| String (body) | This is only required when you specify a
|
|
| String (body) | Change the timezone of the query, only for mode types different from JSON. This parameter supports any positive or negative GMT timezones, like |
|
| String (body) | When |
|
| Number (body) | You can use either the |
|
| Number (body) | Limit the results of the query. The query will stop after returning the first X elements of the query or reaching its end. |
|
| Boolean (body) | Set this parameter to true ( |
|
| String (body) | Query priority |
|
| Boolean (body) | Set this parameter to true if you want to get progress info about the requested query. You will get an entry p with the timestamp of the event that is being processed at that moment. Progress info will be sent at most once every 5s. This is only available if you set |
|
| Boolean (body) | Specifies whether partial results are allowed or not ( |
|
| Object (body) | Object with information about the keep alive message for CSV, TSV and XLS modes. If not provided, live queries aren't accepted for the mentioned modes. Note that this object doesn't apply to any JSON mode. |
|
| String (body) | If you set this as |
|
| String (body) | Configurable token to be sent as a keep alive message for the token type. The default value is |
|
Examples
{
"query": "from demo.ecommerce.data select *",
"from": 1519645036,
"to": 1519645136,
"mode": {
"type": "json"
},
"destination": {
"type": "hdfs",
"params": {
"param1": "value1",
"param1": "value2"
}
}
}.
{
"from": 1519989362,
"mode": {
"type": "json/simple"
},
"query": "from my.synthesis.vec00.suricataalert group every 30s every 30s select *",
"to": 1519989392
}{
"query": "from demo.ecommerce.data select *",
"limit": 10,
"from": 1528306922,
"to": 1528306952,
"mode": {
"type": "tsv"
}
}Relative dates
A relative date range is a period of time that is relative to the current date (last week, last month, etc). You can add different operators to the from and to parameters of your query request to indicate specific time ranges. Note that the date you enter in the to parameter must always be greater than or equal to the from date.
For all the examples that don't use a timestamp to specify a date, we assume that the moment of execution is 08-10-2018, 14:33:12 UTC.
Dates
Operator | Description |
|---|---|
| Get the current day at 00:00:00. Note that the
|
| Get the current day and time
|
| If you use this in the
|
| If you use this in the
|
Days
Operator | Description |
|---|---|
| Enter a number followed by
|
| Enter a number followed by
|
Hours
Operator | Description |
|---|---|
| Enter a number followed by
|
| Enter a number followed by
|
Query response formats
Responses to your queries can be either returned to the source of the request, forwarded to an HDFS, S3, SNMP, or Kafka type system, or sent via email.
Given the different possible destinations for query responses, you can also specify the format in which you want the response to be sent. This is specified in the mode.type parameter of the request body. The available response formats are:
Response type JSON
This is the default response format. This means that if you leave out the mode object from the request body, the response will automatically be returned in this format.
So, to receive responses in JSON format, you can either leave the mode object out of the request or you can specify it like this:
The JSON response will include the following fields:
Field name | Type | Description |
|---|---|---|
| String | This describes the error in the case that the request was not successful. This field will be named The corresponding error code will be shown in the |
| Integer | Numeric value that specifies the error code. When it shows These are the possible error codes that you may get. The corresponding error descriptions will be displayed in the
Also, when you get a
|
| JSON Object | This object contains the query result. The format of the object's content depends on the query data. |
| String | An ID value to uniquely identify yourself across multiple systems. |
| String | Indicates the moment when a certain event occurred. |
Example
Here is a response in JSON format that occurred without error.
Response type JSON/compact
To receive responses in JSON/compact format, specify the mode object in your request like this:
The JSON/compact response will include the following fields:
The
mobject lists the fields included in each query result along with theirtypeandindexmetadata.
Field name | Description |
|---|---|
| The data type of the value returned. This will be one of:
|
| An integer value that indicates the position of the field's value in the arrays returned in the object.d object. |
The
metadataobject gives information about the fields as an array, and includes the following fields:
Field name | Description |
|---|---|
| Name of the field. |
| The data type of the value returned. This will be one of:
|
The object
dincludes lightweight event info.
Example
Here is an example of a response in JSON/compact format that occurred without error:
Response type JSON/simple
To receive responses in JSON/simple format, specify the mode object in your request like this:
The response is a stream of JSON objects of the values that the query generates with the structure below. When the query does not generate more information, the connection is closed by the server. In case no date to value is requested, the connections are kept alive.
Example
Response type JSON/simple/compact
To receive responses in JSON/simple/compact format, specify the mode object in your request like this:
The response is a stream of JSON objects with the following structure:
The
mobject lists the fields included in each query result along with theirtypeandindexmetadata.
Field name | Description |
|---|---|
| The data type of the value returned. This will be one of:
|
| An integer value that indicates the position of the field's value in the arrays returned in the object.d object. |
The
metadataobject gives information about the fields as an array, and includes the following fields:
Field name | Description |
|---|---|
| Name of the field. |
| The data type of the value returned. This will be one of:
|
The object
dincludes the array of values with the returned events data. Every row is a valid JSON object.
When the query does not generate more information, the connection is closed by the server. In case no date to value is requested, the connections are kept alive.
You can receive a timestamp indicating the progress data as an entry p in your response, if the progressInfo parameter is set to true in the request.
Example
Response type MsgPack
To receive responses in MsgPack format, specify the mode object in your request like this:
The response format is the same as a JSON object, but encoded using MsgPack, an efficient binary serialization format. See the msgpack website for more information.
Response type CSV
To receive responses in CSV format, specify the mode object in your request like this:
The system will return the information in CSV (Comma Separated Values) format. The following is a simple example of a CSV response.
Example
|
|---|
Response type TSV
To receive responses in TSV format, specify the mode object in your request like this:
The system will return the information in CSV (Comma Separated Values) format. The following is a simple example of a TSV response.
Example
|
|---|
Response type Excel
To receive responses in XLS format, specify the mode object in your request like this:
The system sends the query results in a Microsoft Excel format file.