Skip to content

The live event stream ​

The same envelopes webhooks deliver are available as a live stream over server sent events, for a console, a terminal or an agent that wants to watch the server rather than be called. The stream is available from release 8.9.0.

GET /api/v1/sa/events/stream?block=3000,7000&minLevel=warn&vsite=default
GET /api/v1/adm/events/stream?eventId=3102,3103&record=false
Authorization: Bearer <JWT or automation token>
Accept: text/event-stream
  • eventId and block are comma separated lists; both empty means every event.
  • minLevel drops records below that level (trace, debug, info, warn, error).
  • vsite (SuperAdmin plane only) restricts the stream to one virtual site; empty means every site. On the Admin plane the stream always carries the administrator's own site. The route needs the Logging permission there, since it is a live view of the log.
  • record=false leaves the log record out of each frame, which keeps the stream small.

An invalid filter is refused with 400 and the reason code webrest.events.filter.invalid.

Frames ​

retry: 5000

event: logevent
id: 1
data: {"specVersion":1,"eventId":3102,"event":"SignInWrongPassword","level":"warn", ... ,"seq":1}

: keepalive

event: dropped
data: {"dropped":12}

event: end
data: {"reason":"tokenExpired"}

The first line tells an EventSource how long to wait before reconnecting. A logevent frame carries the envelope with a sequence number, seq, that also serves as the frame id. A keepalive comment comes every fifteen seconds. A dropped frame says how many frames the consumer missed because it read too slowly; the stream buffers a bounded number of frames per consumer and never stalls the server. An end frame closes the stream when the token expires or after one hour (maxDuration); reconnect to continue.

While at least one stream is open on a node, that node's workers forward their events to the console over the control channel, in batches; the forwarding stops by itself within a minute of the last stream closing. The stream shows the events of this node only: in a cluster, open one stream per node or use a webhook.