Query for Flows
This endpoint returns the list of flows matching the filter criteria. Each flow object in the result has attributes that are a union of flow dimensions (returned by the flow dimensions API above) as well as the flow metrics (returned by the flow metrics API above).
POST /openapi/v1/flowsearch
The list of columns that can be specified in the filter criteria can be obtained by /openapi/v1/flowsearch/ dimensions API.
Parameters: The query body consists of a JSON body with the following keys.
|
Name |
Type |
Description |
|---|---|---|
|
t0 |
integer or string |
Flow search start time (epoch or ISO 8601) |
|
t1 |
integer or string |
Flow search end time (epoch or ISO 8601) |
|
filter |
JSON |
Query filter. If filter is empty (i.e. {}), query matches all flows. |
|
scopeName |
string |
Full name of the scope to which query is restricted. |
|
dimensions |
array |
(Optional) List of dimension names to be returned in the result of flowsearch API. This is an optional parameter. If unspecified, flowsearch results return all the available dimensions. This option is useful to specify a subset of the available dimensions when caller does not care about the rest of the dimensions. |
|
metrics |
array |
(Optional) List of metric names to be returned in the result of flowsearch API. This is an optional parameter. If unspecified, flowsearch results return all the available metrics. This option is useful to specify a subset of the available metrics when caller does not care about the rest of the metrics. |
|
limit |
integer |
(Optional) Number of response flows limit. |
|
offset |
string |
(Optional) Offset object received from previous response. |
|
descending |
boolean |
(Optional) If this parameter is false or left unspecified, results are in ascending order of timestamps. If parameter value is true, results are in descending order of timestamps. |
The body of the request should be a JSON formatted query. An example of a query body is shown below.
{
"t0": "2016-06-17T09:00:00-0700",
"t1": "2016-06-17T17:00:00-0700",
"filter": {
"type": "and",
"filters": [
{
"type": "contains",
"field": "dst_hostname",
"value": "prod"
},
{
"type": "in",
"field": "dst_port",
"values": ["80", "443"]
}
]
},
"scopeName": "Default:Production:Web",
"limit": 100,
"offset": <offset-object>
}