{
  "name":"and",
  "arguments":[
    {
      "name":"eq",
      "arguments":[
        "active",true
      ]
    },
    {
      "name":"like",
      "arguments":[
        "message","*fallaPCI*"
      ]
    }
  ]
}

Doing the body this way, responds a 200 (ok) with the body:

{
    "items": [
        {
            "eventType": {
                "dataSourceId": 652,
                "dataPointId": 13948,
                "pointEventDetectorId": 194,
                "duplicateHandling": 2,
                "eventType": "DATA_POINT",
                "eventSubtype": null,
                "referenceId1": 13948,
                "referenceId2": 194,
                "systemMessage": false,
                "rateLimited": false,
                "publisherId": -1
            },
            "message": "fallaPCI",
            "id": 105235,
            "active": true,
            "status": "",
            "alarmLevel": "CRITICAL",
            "activeTimestamp": 1552682510905,
            "acknowledged": false,
            "comments": null,
            "acknowledgedTimestamp": 0,
            "acknowledgedByUserId": 0,
            "acknowledgedByUsername": null,
            "acknowledgedMessage": null,
            "returnToNormalTimestamp": 0
        }
    ],
    "total": 1
}

We solved all of the doubts. Thank you very much!!!

{
    "cause": "IndexOutOfBoundsException: Index: 1, Size: 1",
    "mangoStatusCode": -1,
    "mangoStatusName": null,
    "localizedMessage": "Internal Server Error"
}

{
  "name": "eq",
  "arguments": ["common.default|fallaPCI|"]
}

You can do more complex queries like

{
  "name":"or",
  "arguments":[
    {
      "name":"eq",
      "arguments":[
        "common.default|fallaPCI|"
      ]
    },
    {
      "name":"like",
      "arguments":[
        "common.default*"
      ]
    }
  ]
}

But we also want to implement the POST endpoint '/v1/events/query'. We are using this body (in this case to see which events are active):

{
  "arguments": [
    {"active": true}
  ],
  "argumentsSize": 1,
  "name": "string",
  "nameValid": true,
  "rootNode": true
}

But it returns a status 500 (Server Error) with this body:

{
    "cause": "RQLToSQLParseException: Unsupported operation: string",
    "mangoStatusCode": -1,
    "mangoStatusName": null,
    "localizedMessage": "Internal Server Error"
}

Can you give us an example of how to use this endpoint?

But when we try to filter by 'message', it does not show us any results, even though the filter has the same coincidence with the three events:

The reason for this is that the message is not stored in the SQL database as a plain string, it is stored as a translatable key with arguments. Try running SELECT * FROM EVENTS ORDER BY ACTIVETS DESC LIMIT 10; from the SQL console to see what I mean. You can filter on it but your query will have to match the format in the DB, try using the RQL like operator. e.g. /rest/v1/events?message=like=event.detector.lowLimitPeriod*&sort(-activeTimestamp)&limit(10,0)

@johautt said in Events filtering:

How the endpoint '/v1/events/module-defined-query' works.

Honestly I'm not sure myself. I don't think it is what you what. @terrypacker might be able to help.

@johautt said in Events filtering:

We also are trying with '/v1/events/query'.

This is the same as RQL query endpoint but it is a POST endpoint that takes a JSON query object in the body instead of query parameters in the URL.