api

Use Tenzir's REST API directly from a pipeline.

api endpoint:str, [request_body=str]

Description

The api operator interacts with Tenzir's REST API without needing to spin up a web server, making all APIs accessible from within pipelines.

endpoint: str

The endpoint to request, e.g., /pipeline/list to list all managed pipelines.

Tenzir's REST API specification lists all available endpoints.

request_body = str (optional)

A single string containing the JSON request body to send with the request.

Examples

List all running pipelines:

api "/pipeline/list"

Create a new pipeline and start it immediately.

api "/pipeline/create", request_body=r#"{"name": "Suricata Import", "definition": "from file /tmp/eve.sock read suricata", "autostart": {"created": true}}"#