serve Make events available under the /serve
REST API
endpoint .
serve id : str, [buffer_size = int]
Description The serve
operator bridges between pipelines and the corresponding /serve
REST API endpoint :
eyJ2ZXJzaW9uIjoiMSIsImVuY29kaW5nIjoiYnN0cmluZyIsImNvbXByZXNzZWQiOnRydWUsImVuY29kZWQiOiJ4nO1Z2VLbSFx1MDAxNH3nKyjPKyi9L3mzg1x0TFx1MDAxMsJiXHUwMDA3yEyKXHUwMDEyUtvWIEtCkllC8e/TkrG1WF5cdTAwMDA7eGpcIqqwfbvVfVt9z7nntlx1MDAxZTY2N2vxfaBq7zdr6s4yXcdcdTAwMGXN29pWYr9RYeT4nm5C6e/IXHUwMDFmhFbas1x1MDAxN8dB9P7dOzNcYozsLsPy+8M7lav6yosj3fcv/Xtz8yH9n5vLdTyV9k2t2Uyc47L1wPfSWVx1MDAwNSOAU4nG7U60oyeKla1cdTAwMWI7plx1MDAxYqmsJTHVXHUwMDA2Le9cZvxcdTAwMTR++1x1MDAxONGdI/aPbym0nU3acVxc9yS+d4crMq3eIMy5XHUwMDE0xaF/pU5cdTAwMWQ77ul2WLKP77P9OHFg3Fx1MDAxY/qDbs9TUVS4yVx1MDAwZkzLie9cdTAwMTNcdTAwMWJcdTAwMDBjq+l100Eyy13Sg1x1MDAxMINcdTAwMTCKIIKUcyhotuBkXHUwMDAwLLkhucBcdTAwMDRIRCBcdTAwMTKs5NlcdTAwMDff9cPEsz9AemWuXZrWVVf759lZXHUwMDFmS9nENrM+t0/rXHUwMDE1mU895XR7sbaRzFx1MDAxNqn0oUNcdTAwMGWpnlx1MDAwMuV6J1x1MDAxM1x1MDAwNPt2uvM/skdcdTAwMWSafbWfbsqX+v3R52BcdTAwMGZ8jT5f9FutRvfs3DwtPD/Pfnp+3sB1M++ThmYurrLRXHUwMDA3gW1cdTAwMGWjXHUwMDAwMsk4Z5hcdTAwMTBcdTAwMDKyx6Zj7ao8nOtbV1x1MDAxNYFcdTAwMTPFZlx1MDAxODdcdTAwMWPPdrxu+Vx1MDAxNuXZU1pcXDOKP/j9vpPEwqHveHG5RzpuPVxm/dueMu2Kkae2XHUwMDA1yXBcdTAwMTmQkiv7tpnFTvpj/P3H1vzeZG539sz+otBcdTAwMWZcdTAwMDFcdTAwMDPkL/i86bBBKeJcdTAwMTAzLlx1MDAwNFx1MDAwMFx1MDAxNEC1XHLps1x1MDAxNpjzdyP/+bj1PE5cdTAwMTJcdTAwMDSWrSNOoowzJFx1MDAwMcxQOI+U0D78eL673zm4XHUwMDBlLtvnN1x1MDAwN0wpTNaelFx1MDAxMPrPkFx1MDAxMlx1MDAxMZqQmMSZXHUwMDBmvzlpnTlcdJVI4zeHvYbDzGTPqkhcZjNWto5IXGbp6GSMXHUwMDAysjCJtYN63Sd+s3ta/354ctz7elx1MDAxMXXgkkks8rWqXFwmh2EhXHIqXHUwMDAxkprDJEOIXHUwMDE2KIzARSlMXHUwMDAxXGYxnE1hSipLdSYpjFx1MDAxMkMgwjRcdTAwMTVcdTAwMDBBXHUwMDA1Y3KS0SZcdI0xrXuBXFxccqE9jFx1MDAwM2xcdTAwMTRD6Mny+LY8l3PsqZxcdTAwMTiurS+vd759+fo9wFx1MDAxNyfRWVx1MDAwZtw1wXazlmGm1vGtQVx1MDAxYSV6tzlcdTAwMTZcYlx1MDAwMoSRwFx1MDAwMPJcXKeuXHUwMDE5pFrbkJhojFIqkH7IZHLtv4xhk6ydbdFSKXZq1JXuXohhYnVcdTAwMTdXXHUwMDExXGbCtGxcdTAwMWRcdTAwMTFcZoZcdTAwMTJIjIBYmGBmb/K6XHUwMDEyjFx1MDAxNFx1MDAwNlx1MDAxNIBr+uBaKUlcXGRcdTAwMThMsVx1MDAwMVxi1qlcdTAwMDAzXcZCQEueLYliqIG4lEwgpuszwbNZxlx1MDAxNEMnKzmCkFx1MDAwNlxiXCJvUcmNXHUwMDAz8CFcdTAwMTeWXHUwMDBiZZpCYFx1MDAwZVPfuOVxXHUwMDE0zavgqo7vxSfOz5QuQcG6a/ZcdTAwMWT3vlx1MDAxMEMpYrSDx82T1t9e/XC/Vmiqu043XHUwMDAxUM3SXHUwMDBmRIVcdTAwMDVsxY5luuNcdTAwMGWxXHUwMDFmZK2WnszUXHUwMDE1S7g/wSx+6HRcdTAwMWTPdFvTJ05qnb1RPEAjl1xmL81IpZWQzjz4ZVqD5J5JiVxuIJSUQinh4sc4e4Houl43bFx1MDAxZLTOdi122LTuflx1MDAxZa07XHUwMDE3XHUwMDEwUSqYXig2oEr+XsZcdTAwMDR8XHUwMDExdVx1MDAwMaXOfFx1MDAwMkiRqb//tby43v10Jzq++Vx0nV5cdTAwMWbef1x1MDAxYjSvjm/2quTFNjI0wzLN9kBoamdaPEzqXHUwMDBianCu95hhSjQomJgtL6b51Du6aKCdz1x1MDAxMT6KrY9A4bO9xpeTKp/ApFx1MDAwN1x1MDAxMzO+QLbU4tBcdTAwMTmG+a8vXHUwMDBm+avESqisuOR5RlOQT1UskLNkW/Oie1x1MDAxZU3N3qQ1pSnKZtFcdTAwMTSmy6Spacc6kFWc60A0yVRcdTAwMDAwrqHEVqNRJplcbs9nqlnSZXbeKoRpWbpsVY9bKcFzM4JW0/TO/jyXjZvm8T+dxqe23b9YrVwimom+aaVcdTAwMDLMZaZcdH1cdTAwMDCgRCB/fDdcdTAwMGZ41atec+AxJFxmgChCXHUwMDFhWZwyhFx1MDAwYsAjgFx1MDAxYWTl+lx1MDAwMCNDYF0pJLUvhqiiUMjZxiDkiDKd9VYjXHUwMDE33uB49UVSvlx1MDAxZVx1MDAwNC9cdTAwMTXxfce28/moqOPnpZGytC84spCoh+JFmMWIl61jzEpcbijQNefimn62ylpTzFx1MDAxMslccoSYgJBcdTAwMDMkOMwgkGJcdTAwMTZjg1x1MDAxM631OOKC6i+85NhyQEuZoTEridBcdTAwMTlSO1x1MDAwMis0flx1MDAwNWpcdTAwMTFcIlxmQvomqF1RjlxcQTJ7XHUwMDFkJ+y1Woe/urIvzrlcZvxPe1x0XG5cdTAwMDGaqpZcdTAwMDWhXHUwMDFhXHUwMDExlC1+vvftOti5bodn8HLnY68tdm5C9qG97vjHgFx1MDAxYkBjmzFINf55ttzhO1BpXGIkiYYkQZhL/jr8v+4lqHZCXHUwMDEwXHUwMDA23uI07/c70ORaq3eg4lX9n+fNcyv0NFx1MDAwNKtcYochUraO+IYgXCKI0EBcXJhv5kT3evJcckpTPSOMXHUwMDEywVx1MDAxMNKiokg4hFx1MDAxOURqXHLAsNZcdTAwMWRcdTAwMWO+qkiIQ9OLXHUwMDAyM9QoruKcqlxunVx1MDAwMENottPETyjVXub47kl1QKiLXHUwMDFizHN5YVx1MDAxZVxyXHUwMDE1ILYszoG5XHUwMDE3Mc/gXHUwMDFjL1x0zGHXYVx1MDAwNG88IaBmXHUwMDA2wUmsp6mNTlxyajeOum1UsHgnvVx1MDAxMtWSxn9cdTAwMTJoKj1seNx4/Fx1MDAxN4m24lx0In0=REST API App HTTP
Pipelines ending with the serve
operator exit when all events have been
delivered over the corresponding endpoint.
id: str
An identifier that uniquely identifies the operator. The serve
operator errors when receiving a duplicate serve id.
buffer_size = int (optional)
The buffer size specifies the maximum number of events to keep in the serve
operator to make them instantly available in the corresponding endpoint before
throttling the pipeline execution.
Defaults to 1Ki
.
Examples Normal Usage Read a Zeek conn.log
and make it available as zeek-conn-logs
:
load_file "path/to/conn.log"
read_zeek_tsv
serve "zeek-conn-logs" '
Then fetch the first 100 events from the /serve
endpoint:
curl \
-X POST \
-H "Content-Type: application/json" \
-d '{"serve_id": "zeek-conn-logs", "continuation_token": null, "timeout": "1s", "max_events": 100}' \
http://localhost:5160/api/v0/serve
This will return up to 100 events, or less if the specified timeout of 1 second
expired.
Subsequent results for further events must specify a continuation token. The
token is included in the response under next_continuation_token
if there are
further events to be retrieved from the endpoint.
Wait for First Event This pipeline will produce 10 events after 3 seconds of doing nothing.
shell "sleep 3; jq --null-input '{foo: 1}'"
read_json
repeat 10
serve "slow-events"
curl \
-X POST \
-H "Content-Type: application/json" \
-d '{"serve_id": "slow-events", "continuation_token": null, "timeout": "5s", "min_events": 1}' \
http://localhost:5160/api/v0/serve
The call to /serve
will wait up to 5 seconds for the first event from the pipeline arriving at the serve operator,
and return immediately once the first event arrives.