Skip to content

K8s Events Query.

POST
/api/data/namespaces/{namespace}/site/{site}/k8s_events
curl --request POST \
--url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/data/namespaces/example/site/example/k8s_events \
--header 'Authorization: <Authorization>' \
--header 'Content-Type: application/json' \
--data '{ "aggs": {}, "end_time": "example", "limit": 1, "namespace": "example", "query": "example", "scroll": true, "site": "example", "sort": "DESCENDING", "start_time": "example", "search_after": true, "sort_values": { "last_doc_id": "example", "last_timestamp": 1 } }'

Request to GET physical K8s events that matches the criteria in request for a given namespace. If no match conditions are specified in the request, then the response contains all K8s events in the namespace. User with access to the system namespace may query for K8s events across all namespaces in a K8s Cluster.

Examples of this operation.

namespace
required
string

Namespace fetch K8s events for the given namespace.

site
required
string

Site Site where the K8s Cluster is running.

Media typeapplication/json
K8s Events Request

Request to fetch physical K8s events.

object
aggs
aggregations

Aggregations provide summary/analytics data over the events response. If the number of events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key’ed by user-defined aggregation name. The response will be key’ed with the same name. Optional.

object
end_time
end time

Fetch vK8s events whose timestamp <= end_time format: unix_timestamp|RFC 3339

Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to

string
<= 1024 characters
limit
limit

Limits the number of K8s events returned in the response Optional: If not specified, first or last 500 events that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.

integer format: int32
namespace
namespace

Fetch K8s events for the given namespace.

string
>= 6 characters <= 1024 characters
query
query

Query is used to specify the list of matchers syntax for query := {[]} := <field_name>"" <field_name> := string One or more of the following fields in the event may be specified in the query. involvedobject.kind - The object that this event is about, like Pod, Deployment, Node, etc. involvedobject.name - Name of the object type - Type of event such as Warning or Normal reason - A one-word description for an event. For example Pending, Running, Succeeded, Failed are some of values for reason that indicate the phase of a Pod lifecycle. source.component - The K8s component reporting the event such as kubelet, kube-scheduler, etc., site - Name of the site := string := [”=”|”!=”|”=”|”!”] = : equal to != : not equal to =~ : regex match !~ : not regex match

Optional: If not specified, all the K8s events for the given tenant and namespace are returned.

string
<= 1024 characters
scroll
scroll

Scroll is used to retrieve large number of events (or all events) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of events until there are no more events left to return. The number of events in each batch is determined by the limit field. Note: Scroll is used for processing large amount of data and therefore is not intended for real time user request. Optional: default is false.

boolean format: boolean
site
site

Site where the K8s Cluster is running.

string
<= 1024 characters
sort
string
default: DESCENDING
Allowed values: DESCENDING ASCENDING
start_time
start time

Fetch vK8s events whose timestamp >= start_time format: unix_timestamp|RFC 3339

Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.

string
<= 1024 characters
search_after
search after

Search After is used to retrieve large number of log messages (or all log messages) that matches the query. If search_after is set to true, the sort_values in the response can be used in the API to fetch the next batch of logs. The number of messages in each batch is determined by the limit field. Note: Search After is used for processing large amount of data and therefore is not intended for real time user request. Optional: default is false.

boolean format: boolean
sort_values
object
last_doc_id
last_doc_id

This is a unique UUID generated by elastic search.

string
<= 1024 characters
last_timestamp
last timestamp

Configuration parameter for last timestamp

number format: double

A successful response.

Media typeapplication/json
LogResponse

Response message for AuditLogRequest/AccessLogRequest/LogScrollRequest.

object
aggs
aggregations

Aggregations provide summary/analytics data over the log response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key’ed with the aggregation name specified in the request.

object
logs
logs

List of log messages that matched the query. Not all log messages that matched the query are returned in the response.

Array<string>
scroll_id
scroll id

Long Base-64 encoded string which can be used to retrieve next batch of log messages using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF). Note: scroll_id is valid only for 2 minutes. I.e., If one intend to retrieve next batch of the result, then the scroll request should be sent within 2 minutes upon receiving the LogResponse.

string
<= 1024 characters
total_hits
total hits

Total number of log messages that matched the query.

string format: uint64
<= 1024 characters
last_sort_values
object
last_doc_id
last_doc_id

This is a unique UUID generated by elastic search.

string
<= 1024 characters
last_timestamp
last timestamp

Configuration parameter for last timestamp

number format: double
Examplegenerated
{
"aggs": {},
"logs": [
"example"
],
"scroll_id": "example",
"total_hits": "example",
"last_sort_values": {
"last_doc_id": "example",
"last_timestamp": 1
}
}

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example