Skip to content

Read multiple pipeline outputs

POST
/serve-multi
 
curl --request POST \
  --url https://example.com/api/v0/serve-multi \
  --header 'Content-Type: application/json' \
  --header 'X-Tenzir-Token: <X-Tenzir-Token>' \
  --data '{ "requests": [ { "serve_id": "query-1", "continuation_token": null }, { "serve_id": "query-2", "continuation_token": "340ce2j" } ], "max_events": 1024, "min_events": 1, "timeout": "5s", "schema": "exact" }'

Reads events from multiple existing pipeline output streams. By default, the endpoint uses long polling (timeout: 5s) and returns as soon as at least one event is available (min_events: 1).

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”

Pipeline output batch request.

Media type application/json
object
requests
required
Array<object>
>= 1 items
object
serve_id
required

The output stream identifier returned when the pipeline was launched.

string
continuation_token

The continuation token from the previous response for this output stream. Omit this field for the initial request.

string
max_events

The maximum number of events to return across all requested output streams. The limit is split evenly across streams and rounded up when necessary.

integer
default: 1024
min_events

The minimum number of events to wait for across all requested output streams before returning. The limit is split evenly across streams and rounded up when necessary.

integer
default: 1
timeout

The maximum time to spend on the request. Reaching the timeout returns the available events and is not an error. The timeout must not be greater than 10 seconds.

string
default: 5s
schema

The schema representation to include in each response. Use exact for a representation that matches Tenzir’s type system exactly, and never to omit schema definitions.

string
default: legacy
Allowed values: legacy exact never
Example 
{
  "requests": [
    {
      "serve_id": "query-1",
      "continuation_token": null
    },
    {
      "serve_id": "query-2",
      "continuation_token": "340ce2j"
    }
  ],
  "max_events": 1024,
  "min_events": 1,
  "timeout": "5s",
  "schema": "exact"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

The response contains one entry for each requested output stream.

Media type application/json
object
key
additional properties

A response keyed by output stream identifier.

object
next_continuation_token
required

The token to use when reading the next batch. The value is null when the pipeline reached a terminal state.

string
nullable
state
required

The pipeline state at the time of the request.

string
Allowed values: running completed failed
schemas

The schemas for the returned events. This field is omitted when the request sets schema to never.

Array<object>
object
schema_id

The unique schema identifier.

string
definition

The schema definition in JSON format.

events
required

The returned events.

Array<object>
object
schema_id

The unique schema identifier.

string
data

The event data in JSON format.

object
Example 
{
  "query-1": {
    "next_continuation_token": "340ce2j",
    "state": "running",
    "schemas": [],
    "events": [
      {
        "schema_id": "c631d301e4b18f4",
        "data": {
          "timestamp": "2023-04-26T12:00:00Z",
          "schema": "zeek.conn",
          "events": 50
        }
      }
    ]
  },
  "query-2": {
    "next_continuation_token": null,
    "state": "completed",
    "schemas": [],
    "events": []
  }
}

400

Section titled “400 ”

The request body is invalid.

Media type application/json
object
error
required

The error message.

string
Example 
{
  "error": "Invalid arguments"
}