The live event stream
The same envelopes webhooks deliver are available as a live stream over server sent events, for a console, a terminal or an agent that wants to watch the server rather than be called. The stream is available from release 8.9.0.
GET /api/v1/sa/events/stream?block=3000,7000&minLevel=warn&vsite=default
GET /api/v1/adm/events/stream?eventId=3102,3103&record=false
Authorization: Bearer <JWT or automation token>
Accept: text/event-streameventIdandblockare comma separated lists; both empty means every event.minLeveldrops records below that level (trace, debug, info, warn, error).vsite(SuperAdmin plane only) restricts the stream to one virtual site; empty means every site. On the Admin plane the stream always carries the administrator's own site. The route needs the Logging permission there, since it is a live view of the log.record=falseleaves the log record out of each frame, which keeps the stream small.
An invalid filter is refused with 400 and the reason code webrest.events.filter.invalid.
Frames
retry: 5000
event: logevent
id: 1
data: {"specVersion":1,"eventId":3102,"event":"SignInWrongPassword","level":"warn", ... ,"seq":1}
: keepalive
event: dropped
data: {"dropped":12}
event: end
data: {"reason":"tokenExpired"}The first line tells an EventSource how long to wait before reconnecting. A logevent frame carries the envelope with a sequence number, seq, that also serves as the frame id. A keepalive comment comes every fifteen seconds. A dropped frame says how many frames the consumer missed because it read too slowly; the stream buffers a bounded number of frames per consumer and never stalls the server. An end frame closes the stream when the token expires or after one hour (maxDuration); reconnect to continue.
While at least one stream is open on a node, that node's workers forward their events to the console over the control channel, in batches; the forwarding stops by itself within a minute of the last stream closing. The stream shows the events of this node only: in a cluster, open one stream per node or use a webhook.
