core/v2/filters

NOTE: Requests to core/v2/filters API endpoints require you to authenticate with a Sensu API key or access token. The code examples in this document use the environment variable $SENSU_API_KEY to represent a valid API key in API requests.

Get all event filters

The /filters API endpoint provides HTTP GET access to event filter data.

Example

The following example demonstrates a GET request to the /filters API endpoint:

curl -X GET \
http://127.0.0.1:8080/api/core/v2/namespaces/default/filters \
-H "Authorization: Bearer $TOKEN"

The request results in a successful HTTP/1.1 200 OK response and a JSON array that contains the event filter definitions in the default namespace:

[
  {
    "metadata": {
      "name": "development_filter",
       "namespace": "default",
       "created_by": "admin"
    },
    "action": "deny",
    "expressions": [
      "event.entity.metadata.namespace == 'development'"
    ],
    "runtime_assets": null
  },
  {
    "metadata": {
      "name": "state_change_only",
      "namespace": "default"
    },
    "action": "allow",
    "expressions": [
      "event.check.occurrences == 1"
    ],
    "runtime_assets": null
  }
]

API Specification

/filters (GET)
description Returns the list of event filters.
example url http://hostname:8080/api/core/v2/namespaces/default/filters
pagination This endpoint supports pagination using the limit and continue query parameters.
response filtering This endpoint supports API response filtering.
response type Array
response codes
  • Success: 200 (OK)
  • Error: 500 (Internal Server Error)
output 
[
  {
    "metadata": {
      "name": "development_filter",
       "namespace": "default",
       "created_by": "admin"
    },
    "action": "deny",
    "expressions": [
      "event.entity.metadata.namespace == 'development'"
    ],
    "runtime_assets": null
  },
  {
    "metadata": {
      "name": "state_change_only",
      "namespace": "default"
    },
    "action": "allow",
    "expressions": [
      "event.check.occurrences == 1"
    ],
    "runtime_assets": null
  }
]

Create a new event filter

The /filters API endpoint provides HTTP POST access to create an event filter.

Example

In the following example, an HTTP POST request is submitted to the /filters API endpoint to create the event filter development_filter.

curl -X POST \
-H "Authorization: Key $SENSU_API_KEY" \
-H 'Content-Type: application/json' \
-d '{
  "metadata": {
    "name": "development_filter",
    "namespace": "default",
    "labels": null,
    "annotations": null
  },
  "action": "deny",
  "expressions": [
    "event.entity.metadata.namespace == 'development'"
  ],
  "runtime_assets": []
}' \
http://127.0.0.1:8080/api/core/v2/namespaces/default/filters

The request will return a successful HTTP/1.1 201 Created response.

API Specification

/filters (POST)
description Creates a Sensu event filter.
example URL http://hostname:8080/api/core/v2/namespaces/default/filters
payload 
{
  "metadata": {
    "name": "development_filter",
    "namespace": "default",
    "labels": null,
    "annotations": null
  },
  "action": "deny",
  "expressions": [
    "event.entity.metadata.namespace == 'development'"
  ],
  "runtime_assets": []
}
response codes
  • Success: 201 (Created)
  • Malformed: 400 (Bad Request)
  • Error: 500 (Internal Server Error)

Get a specific event filter

The /filters/:filter API endpoint provides HTTP GET access to event filter data for specific :filter definitions, by filter name.

Example

The following example queries the /filters/:filter API endpoint for the :filter named state_change_only:

curl -X GET \
http://127.0.0.1:8080/api/core/v2/namespaces/default/filters/state_change_only \
-H "Authorization: Bearer $TOKEN"

The request will return a successful HTTP/1.1 200 OK response and a JSON map that contains the requested :filter definition (in this example, state_change_only):

{
  "metadata": {
    "name": "state_change_only",
    "namespace": "default",
    "created_by": "admin"
  },
  "action": "allow",
  "expressions": [
    "event.check.occurrences == 1"
  ],
  "runtime_assets": null
}

API Specification

/filters/:filter (GET)
description Returns the specified event filter.
example url http://hostname:8080/api/core/v2/namespaces/default/filters/state_change_only
response type Map
response codes
  • Success: 200 (OK)
  • Missing: 404 (Not Found)
  • Error: 500 (Internal Server Error)
output 
{
  "metadata": {
    "name": "state_change_only",
    "namespace": "default",
    "created_by": "admin"
  },
  "action": "allow",
  "expressions": [
    "event.check.occurrences == 1"
  ],
  "runtime_assets": null
}

Create or update an event filter

The /filters/:filter API endpoint provides HTTP PUT access to create or update an event filter.

Example

In the following example, an HTTP PUT request is submitted to the /filters API endpoint to create the event filter development_filter:

curl -X PUT \
-H "Authorization: Key $SENSU_API_KEY" \
-H 'Content-Type: application/json' \
-d '{
  "metadata": {
    "name": "development_filter",
    "namespace": "default",
    "labels": null,
    "annotations": null
  },
  "action": "deny",
  "expressions": [
    "event.entity.metadata.namespace == 'development'"
  ],
  "runtime_assets": []
}' \
http://127.0.0.1:8080/api/core/v2/namespaces/default/filters/development_filter

The request will return a successful HTTP/1.1 201 Created response.

API Specification

/filters/:filter (PUT)
description Creates or updates the specified Sensu event filter.
example URL http://hostname:8080/api/core/v2/namespaces/default/filters/development_filter
payload 
{
  "metadata": {
    "name": "development_filter",
    "namespace": "default",
    "labels": null,
    "annotations": null
  },
  "action": "deny",
  "expressions": [
    "event.entity.metadata.namespace == 'development'"
  ],
  "runtime_assets": []
}
response codes
  • Success: 201 (Created)
  • Malformed: 400 (Bad Request)
  • Error: 500 (Internal Server Error)

Update a filter with PATCH

The /filters/:filter API endpoint provides HTTP PATCH access to update :filter definitions, specified by filter name.

NOTE: You cannot change a resource’s name or namespace with a PATCH request. Use a PUT request instead.

Also, you cannot add elements to an array with a PATCH request — you must replace the entire array.

Example

In the following example, an HTTP PATCH request is submitted to the /filters/:filter API endpoint to update the expressions array for the us-west filter, resulting in a HTTP/1.1 200 OK response and the updated event filter definition.

We support JSON merge patches, so you must set the Content-Type header to application/merge-patch+json for PATCH requests.

curl -X PATCH \
-H "Authorization: Key $SENSU_API_KEY" \
-H 'Content-Type: application/merge-patch+json' \
-d '{
  "expressions": [
    "event.check.occurrences == 3"
  ]
}' \
http://127.0.0.1:8080/api/core/v2/namespaces/default/filter/us-west

API Specification

/filters/:filter (PATCH)
description Updates the specified Sensu filter.
example URL http://hostname:8080/api/core/v2/namespaces/default/filter/us-west
payload 
{
  "expressions": [
    "event.check.occurrences == 3"
  ]
}
response codes
  • Success: 200 (OK)
  • Malformed: 400 (Bad Request)
  • Error: 500 (Internal Server Error)

Delete an event filter

The /filters/:filter API endpoint provides HTTP DELETE access to delete an event filter from Sensu (specified by the filter name).

Example

The following example shows a request to the /filters/:filter API endpoint to delete the event filter development_filter, which will result in a successful HTTP/1.1 204 No Content response:

curl -X DELETE \
http://127.0.0.1:8080/api/core/v2/namespaces/default/filters/development_filter \
-H "Authorization: Key $SENSU_API_KEY"

API Specification

/filters/:filter (DELETE)
description Removes the specified event filter from Sensu.
example url http://hostname:8080/api/core/v2/namespaces/default/filters/development_filter
response codes
  • Success: 204 (No Content)
  • Missing: 404 (Not Found)
  • Error: 500 (Internal Server Error)

Get a subset of filters with response filtering

The /filters API endpoint supports response filtering for a subset of filter data based on labels and the following fields:

  • filter.name
  • filter.namespace
  • filter.action
  • filter.runtime_assets

Example

The following example demonstrates a request to the /filters API endpoint with response filtering for only filter definitions whose action is allow:

curl -H "Authorization: Key $SENSU_API_KEY" http://127.0.0.1:8080/api/core/v2/filters -G \
--data-urlencode 'fieldSelector=filter.action == allow'

The example request will result in a successful HTTP/1.1 200 OK response and a JSON array that contains only event filter definitions whose action is allow:

[
  {
    "metadata": {
      "name": "filter_interval_60_hourly",
      "namespace": "default",
      "created_by": "admin"
    },
    "action": "allow",
    "expressions": [
      "event.check.interval == 60",
      "event.check.occurrences == 1 || event.check.occurrences % 60 == 0"
    ],
    "runtime_assets": null
  },
  {
    "metadata": {
      "name": "state_change_only",
      "namespace": "default",
      "created_by": "admin"
    },
    "action": "allow",
    "expressions": [
      "event.check.occurrences == 1"
    ],
    "runtime_assets": null
  }
]

NOTE: Read API response filtering for more filter statement examples that demonstrate how to filter responses using different operators with label and field selectors.

API Specification

/filters (GET) with response filters
description Returns the list of filters that match the response filters applied in the API request.
example url http://hostname:8080/api/core/v2/filters
pagination This endpoint supports pagination using the limit and continue query parameters.
response type Array
response codes
  • Success: 200 (OK)
  • Error: 500 (Internal Server Error)
output 
[
  {
    "metadata": {
      "name": "filter_interval_60_hourly",
      "namespace": "default",
      "created_by": "admin"
    },
    "action": "allow",
    "expressions": [
      "event.check.interval == 60",
      "event.check.occurrences == 1 || event.check.occurrences % 60 == 0"
    ],
    "runtime_assets": null
  },
  {
    "metadata": {
      "name": "state_change_only",
      "namespace": "default",
      "created_by": "admin"
    },
    "action": "allow",
    "expressions": [
      "event.check.occurrences == 1"
    ],
    "runtime_assets": null
  }
]