• 0
Mosh

How to use the ~ (includes) filter operator?

Question

Hi,

I need to retrieve alerts by a list of alert IDs.  I thought maybe the includes ~ operator in the filter would be the way to do this, passing a comma separated list of alert IDs:

/alert/alerts?needMessage=true&filter=internalId~LMD2316102,LMD1785737

But this only returns the first alert.

Am I using the ~ operator correctly?  

https://www.logicmonitor.com/support/rest-api-developers-guide/v1/alerts/get-alerts/

Share this post


Link to post
Share on other sites

3 answers to this question

Recommended Posts

  • 0

When I've used commas in Filters previously, I've had to specify the field after each comma, for example "filter=internalId~LMD1234567,clear:*" or "parentId:1,fullPath~Template" so I assume you may need to do something like "filter=internalId~LMD1234567,internalId~LMD7654321". BUT I would have expected it to attempt to search for an alert that has internalId of LMD1234567 AND LMD7654321 which would never exist. So I'm rather surprised it even get one result.

In my testing I get no results for "filter=internalId~LMD1234567,LMD7654321" but I get the first result when I use "filter=internalId~LMD1234567,internalId~LMD7654321", which I didn't expect. So I'm not exactly sure what is up. I do see that the doc doesn't show internalId as a valid filterable field but does seem to work anyway without commas.

Playing around and watching how to portal does it (F12 in browser, network tab) I was able to get a working solution using:

 /alert/alerts?needMessage=true&filter=_all~"*LMD1234567 OR LMD7654321*"

But really it looks hacky and undocumented. I would suggest just putting in two separate API calls for each LMD# and combine in code or get all the alerts and filter via code.

 

Edited by Mike Moniz
  • Upvote 1

Share this post


Link to post
Share on other sites
  • 0

Thanks for your reply @Mike Moniz.


Yes, this has been my finding too, that only the first alert is returned.  I gave up after a while and resorted to looping through and making separately calls for each alert (can't pull all alerts as am only interested in alerts for a particular widget).  Annoyingly using get widget data call doesn't support the alert message detail option either, or there would be no need for the second calls to get alert details.

@Sarah Terry - for info.

Share this post


Link to post
Share on other sites
  • 0

I was trying to do an OR operator as well but in the audit/accesslogs. Mike's comment made me think of using the network tab of the developer tools in Firefox.

The browser uses this:

username:"user1@test.com"|"user2@test.com",_all~SAML

It also works without quotes:

username:user1@test.com|user2@test.com,_all~SAML

 

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.