---
title: "Query Data"
method: GET
path: "/connect/events/"
tags: ["Query"]
---

# Query Data

`GET /connect/events/`

Given a search query, fetch all matching results, up to the maximum number requested, or the maximum that the backend data server will provide.
### Query Structure

The query structure resembles the following:

```
(field_name1:required_value AND field_name2:>50) OR field_name3:"some string value" | groupby field_name1 field_name2 | sortby field_name1 field_name3 | ...
```

Everything the left of the | "pipe" character must be in Lucene syntax.

The operation keywords, such as AND, OR, NOT must always be capitalized.

For more information on the query syntax, refer to the Security Onion documentation and search for `OQL`.

## Query parameters

- `query` string, required
- `range` string, required
- `zone` string, required
- `format` string, required
- `metricLimit` integer, required
- `eventLimit` integer, required

## Response `200`

Outputs the list of search results

- ModelEventSearchResults[]
  - `completeTime` string — The date and time when the search completed
  - `createTime` string — The date and time when the search was submitted
  - `criteria` ModelEventSearchCriteria — The search criteria used in to locate these search results
    - `beginTime` string — The start of the search time range, in the requestor's timezone
    - `createTime` string — The UTC date and time when the search request was submitted
    - `dateRange` string — The date range to use for searching for matching events
    - `endTime` string — The end of the search time range, in the requestor's timezone
    - `eventLimit` integer — The maximum number of events to retrieve
    - `metricLimit` integer — The maximum number of metrics to limit in aggregate groups
    - `query` string — The base query used to conduct the event search
  - `elapsedMs` integer — The number of milliseconds it took to complete the search
  - `errors` string[] — A list of errors that the search encountered. The presence of errors does not necessarily preclude the search from returning events."
  - `events` ModelEventRecord[] — The events that matched the search criteria (limited to the specified eventLimit value, or the max result length as configured in the backend data server)
    - `id` string — The event's unique document ID
    - `payload` object — The event data fields
    - `score` number — The score of the event, often left 0
    - `sort` unknown[] — The values used for the purposes of sorting across the returned event list
      - unknown
    - `source` string — The source index of the event
    - `time` string — The parsed event time
    - `timestamp` string — The event timestamp
    - `type` string — The type of event, often left blank
  - `metrics` object — The collection of aggregated metrics associated with this search
  - `totalEvents` integer — The total number of matching events (not necessarily the total number returned)

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `405` — The event module is not loaded on the server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)