Data

This index stores all the incoming data from the Execution Environment collected by the Agent Instance or eBPF Program Instance installed on them.

Schema

Field

Type

Required

Readonly

Auto Managed

Example

id

String

True

True

False

dsalkasdioi232382yieyqwuiy

agent_instance_id

String

False

True

False

filebeat@mysql-server

ebpf_program_instance_id

String

False

True

False

synflood@mysql-server

timestamp_event

Date

False

True

False

2020/06/04 09:22:09

timestamp_agent

Date

False

True

False

2020/06/04 09:22:19

Warning

  • It is not possible to update readonly fields.

  • it is not possible to set the Auto managed fields.

Note

  • id is required but it is auto-generated if not provided. It is recommended to provide a friendly for simplify the retrieve of connected date in other indices.

  • agent_instance_id should be one of those stored in Agent Instance index.

  • ebpf_program_instance_id should be one of those stored in eBPF Program Instance index.

Create

To create a new data use the following REST call:

POST /data/(string: id)

with the request body in JSON format:

POST /data HTTP/1.1
Host: cb-manager.example.com
Content-Type: application/json

{
    "id": "<data-id>",
    "agent_instance_id": "<agent-instance-id>",
    "timestamp_event": "<timestamp-event>",
    "timestamp_agent": "<timestamp-agent>",
}
Parameters
  • id – optional data id.

Request Headers
Response Headers
Status Codes

Replace the data with the correct values, for example <agent-instance-id> with filebeat@mysql-server.

Note

It is possible to add additional data.

If the creation is correctly executed the response is:

HTTP/1.1 201 Created
Content-Type: application/json

[
    {
        "status": "Created",
        "code": 201,
        "error": false,
        "message": "Data with id=<data-id> correctly created"
    }
]

Otherwise, if, for example, a data with the given id is already found, this is the response:

HTTP/1.1 406 Not Acceptable
Content-Type: application/json

[
    {
        "status": "Not Acceptable",
        "code": 406,
        "error": true,
        "message": "Id already found"
    }
]

Read

To get the list of data:

GET /data/(string: id)

The response includes all the data created.

It is possible to filter the results using the following request body:

GET /data HTTP/1.1
Host: cb-manager.example.com
Content-Type: application/json

{
    "select": [ "type_id" ],
    "where": {
        "equals": {
            "target:" "id",
            "expr": "<data-id>"
        }
    }
}
Parameters
  • id – optional data id.

Request Headers
Response Headers
Status Codes

In this way, it will be returned only the type_id of the data with id = “<data-id>”.

Update

To update a data, use:

PUT /data/(string: id)
PUT /data HTTP/1.1
Host: cb-manager.example.com
Content-Type: application/json

{
    "id": "<data-id>",
    "source": "<ip-address>"
}
Parameters
  • id – optional data id.

Request Headers
Response Headers
Status Codes

This example add a new field source for the data with id = “<data-id>”.

A possible response is:

HTTP/1.1 200 OK
Content-Type: application/json

[
    {
        "status": "OK",
        "code": 200,
        "error": false,
        "message": "Data with id=<data-id> correctly updated"
    }
]

Instead, if the are not changes the response is:

HTTP/1.1 304 Not Modified
Content-Type: application/json

[
    {
        "status": "Not Modified",
        "code": 304,
        "error": false,
        "message": "Update for data with id=<data-id> not necessary"
    }
]

Delete

To delete data, use:

DELETE /data/(string: id)
DELETE /data HTTP/1.1
Host: cb-manager.example.com
Content-Type: application/json

{
    "where": {
        "equals": {
            "target:" "id",
            "expr": "<data-id>"
        }
    }
}
Parameters
  • id – optional data id.

Request Headers
Response Headers
Status Codes

This request removes the data with id = “<data-id>”.

This is a possible response:

HTTP/1.1 205 Reset Content
Content-Type: application/json

[
    {
        "status": "Reset Content",
        "code": 200,
        "error": false,
        "message": "Data with id=<data-id> correctly deleted"
    }
]

Caution

Without request body, it removes all the data.