v51

latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-011189403.1 MB
preview

Capture live data

Initiate a live data capture from Cribl Workers. Returns a stream of captured events in NDJSON format that match the parameters specified in the request body.

post/system/capture

Request body

durationinteger

Amount of time to keep capture open, in seconds. If not provided, the default is 5 seconds.

filterstring

JavaScript expression evaluated against each event to determine whether an event is included in the capture output. Expressions can reference any event field and use logical operators. If not provided, all events are captured.

level0 | 1 | 2 | 3

Stage at which events are captured. <br><code>0</code> == Before pre-processing Pipeline <br><code>1</code> == Before the Routes <br><code>2</code> == Before post-processing Pipeline <br><code>3</code> == Before the Destination.

maxEventsinteger

Maximum number of events to capture. If not provided, the default is 100.

stepDurationinteger

How long to wait before increasing the capture sample size. Specify <code>1</code> second or longer. If not provided, the default is 5 seconds.

workerIdstring

Unique ID of the Worker.

workerThresholdinteger

Maximum number of Workers that can capture initially. A value of <code>0</code> means unlimited (all available Workers can capture). If not provided, the default is 50.

Response

Stream of captured events.