Forum Discussion

MrJ's avatar
MrJ
5 years ago
Solved

Querying alerts via API

Hi I'm fairly new to APIs and would like a little help please. I am trying to query the LM API for specific alerts with Python. I am able to retrieve a full list of alerts via Python which is...
alert
api
  • Anonymous's avatar
    Anonymous
    5 years ago
    48 minutes ago, MrJ said:

    For the v2 API, does it display the data any different or is the only difference no support for basic auth?

    The data structure changes for v2 and some of the endpoints are different. Some more info here. The v2 REST documentation is here: https://www.logicmonitor.com/swagger-ui-master/dist/#/Alerts/getAlertList, but the filtering shouldn't be any different.

    As far as why it's not working (meaning you're getting an http 200 but not filtered results), I am wondering if the filter can only affect those fields included in the response. That being the case, can you filter based on the value of `monitorObjectGroups`? Unfortunately, being end of quarter, I don't have the time to run any tests to figure out what works.

Anonymous's avatar
Anonymous
5 years ago

Ok, was just forced to look at this for someone else and I couldn't get any filter to work using APIv2 (not sure why).

Also, the filters can only be applied on non-list fields in the response json. So, given the response: 

{
  "items": [
    {
      "SDT": {},
      "ackComment": "string",
      "acked": true,
      "ackedBy": "string",
      "ackedEpoch": 0,
      "alertValue": "string",
      "chain": "string",
      "chainId": 0,
      "clearValue": "string",
      "cleared": true,
      "customColumns": {},
      "dataPointId": 0,
      "dataPointName": "string",
      "detailMessage": {},
      "endEpoch": 0,
      "id": "string",
      "instanceDescription": "string",
      "instanceId": 0,
      "instanceName": "string",
      "internalId": "string",
      "monitorObjectGroups": {},
      "monitorObjectId": 0,
      "monitorObjectName": "string",
      "monitorObjectType": "string",
      "nextRecipient": 0,
      "receivedList": "string",
      "resourceId": 0,
      "resourceTemplateId": 0,
      "resourceTemplateName": "string",
      "resourceTemplateType": "string",
      "rule": "string",
      "ruleId": 0,
      "sdted": true,
      "severity": 0,
      "startEpoch": 0,
      "subChainId": 0,
      "threshold": "string",
      "type": "string"
    }
  ],
  "searchId": "string",
  "total": 0
}

You should be able to write a filter like this: 

/alert/alerts?filter=monitorObjectName~domain.com

The documentation states that you should be able to use the ~ operator for "contains", however in my testing, it seems that ~ (contains) behaves exactly the same as : (equals). If this is also your experience, I suggest you open a case with support as it's not working as documented.